The UK General Data Protection Regulation (UK GDPR) is legislation that works with the Data Protection Act 2018 to form the UK's data protection laws.
It sets out the rules for how people’s personal data is processed and kept safe.
This legalisation has been modified by the Data (Use and Access) Act 2025.
The main aim of the DUAA is to promote innovation and economic growth by streamlining data protection processes.
The act doesn't introduce many new requirements – it clarifies existing laws and makes it easier to process data for specific reasons (while still keeping it safe).
Personal data is information relating to a living individual who can be:
- Directly identified from that information; or
- Indirectly identified from that information in combination with other information
See the ICO's guide to personal information for more details.
