Data protection regime—DPA 1998

Copyright © 2025 LexisNexis

ARCHIVED:This Overview provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998) and Directive 95/46/EC (the Data Protection Directive). This Overview is for background information only and is not maintained.

Prior to the 25 May 2018, the DPA 1998 governed the processing of personal data in the UK. It incorporated the provisions of the Data Protection Directive into UK law and obliged those handling personal data to comply with eight core data protection principles (discussed below), giving individuals a number of rights in relation to information that is about them, including a right of access.

The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) was published in the Official Journal of the European Union on 4 May 2016. The provisions of the GDPR are directly applicable and fully enforceable in all EU Member States from 25 May 2018 and it replaces DPA 1998 and Data Protection Directive. For more information, see Practice Note: Introduction to the EU GDPR and UK GDPR.

Position under the DPA 1998

Background

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Information Law News

Guaranteed failure (Peter Dunn v Kostas Kazolides)

Commercial analysis: Dov Ohrenstein of Radcliffe Chambers considers the case of Peter Dunn v Kostas Kazolides which addresses interesting questions about limitation periods, insolvency, the formal requirements for the execution of deeds, and how variation to the contract between the principal debtor and creditor may discharge a guarantor.

ICO finalises updated encryption guidance following consultation responses

The Information Commissioner’s Office (ICO) has published its updated encryption guidance following a public consultation held between May and June 2025, which received 15 responses from stakeholders including technology providers, professionals, and members of the public. The guidance, currently under review due to the enactment of the Data (Use and Access) Act on 19 June 2025, clarifies how UK data protection law, particularly the UK GDPR, applies to encryption as a technical measure for securing personal data. Respondents generally found the draft clear and valued practical case examples, prompting the ICO to reinstate older scenarios, add new ones, and link to archived enforcement notices. Specific feedback on cloud computing led the ICO to defer detailed examples to future updates of its cloud computing guidance, while references to privacy-enhancing technologies were expanded. Requests for more detail on encryption tools and standards resulted in broader references to commonly used software, though discussions on password managers and authentication services were deemed more suitable for other guidance.

Information Law weekly highlights—4 September 2025

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ICO launches consultation on Distributed Ledger Technologies guidance

The Information Commissioner's Office (ICO) has launched a consultation seeking feedback on its draft guidance regarding Distributed Ledger Technologies. The consultation is structured as a survey covering organisational impact, views on the guidance and general comments. The consultation runs until 7 November 2025.

View Information Law by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an
Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companies

Priority between loss reliefs in loss making companiesWhy does it matter?A company that is a member of a group and has incurred any of the types of losses available for surrender by way of group relief may, without any further rules, have more than one way in which to use the loss. There are a

Late payment penalties—inheritance tax

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an