-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Which legal framework will my organisation be processing under?
1. Which legal framework will my organisation be processing under?
The legal regime you will be processing under will depend on whether you are a competent authority and your purposes for processing personal data. The Data Protection Act 2018 (DPA) sets out the UK’s data protection framework, alongside the General Data Protection Regulation (GDPR). It comprises the following data protection regimes:
- Part 2 – supplements and tailors the GDPR in the UK;
- Part 3 – sets out a separate regime for criminal law enforcement processing; and
- Part 4 – sets out a separate regime for the three intelligence services.
We are currently developing our guidance on the separate data protection regime that applies to intelligence services. It will cover the provisions in part 4 of the Data Protection Act 2018 (DPA 2018).