As explained in Practice Note: Introduction to the EU GDPR and UK GDPR, the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) came into force on 24 May 2016, and became directly applicable and enforceable in all EU Member States from 25 May 2018. In the UK, the Data Protection Act 2018 (DPA 2018), which received Royal Assent on 23 May 2018, made a number of detailed provisions relating to how the GDPR applies in the UK, including the creation of certain offences and enforcement powers of the Information Commissioner’s Office (ICO). For more information, see Practice Notes: The Data Protection Act 2018 and Offences under the Data Protection Act 2018. Among other things, DPA 2018 generally repealed the preceding Data Protection Act 1998 (DPA 1998), increased the maximum level of fines in the UK so that they are consistent with the GDPR and introduced new powers and offences in relation to data protection, while replicating