Data Protection Act 2018
(DPA 2018)
The UK statute supplementing the UK GDPR with domestic provisions, exemptions, and enforcement mechanisms. Implements the EU Law Enforcement Directive for criminal justice processing, and the Intelligence Services Directive. Section 170 makes unauthorised obtaining of personal data a criminal offence.
The DPA 2018 implements detailed UK rules alongside the UK GDPR: Part 2 (the GDPR's domestic implementation), Part 3 (Law Enforcement processing under Directive 2016/680), Part 4 (Intelligence Services). The criminal offences include: unlawful obtaining, disclosure, or procurement (s.170 — maximum unlimited fine), re-identification of de-identified data (s.171), and obstruction (s.179). Specific exemptions for journalism, art, literature, research, statistics, archiving (Schedule 2). The Information Commissioner is the regulator.