UK GDPR and the Data Protection Act 2018

Data protection in the UK is governed by two instruments read together. The UK GDPR is the text of Regulation (EU) 2016/679 as retained in UK law, with references to the Union and to supervisory authorities read as the United Kingdom and the Information Commissioner. The Data Protection Act 2018, which received Royal Assent on 23 May 2018, supplements it, fills the gaps the regulation leaves to national law and adds regimes of its own for law enforcement and intelligence services processing.

The regulator is the Information Commissioner's Office. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, replaces the office with a body corporate, the Information Commission, led by a chair who keeps the title Information Commissioner, and gives it new powers, including interview notices and the power to require an organisation to commission and pay for a technical report, for example on how a particular encryption system works. The Act comes into force in stages set by regulations, so check which provisions have commenced before relying on any of them.

This is the United Kingdom's regime only. It is close to the EU GDPR, and the EU has recognised the UK as adequate under both the GDPR and the Law Enforcement Directive, but it is a separate law with a separate regulator, and it drifts from the EU text as the 2025 Act commences. No single privacy rule applies everywhere.

Because the UK GDPR is the retained regulation, its reach follows the same two tests: processing in the context of an establishment in the UK, and processing by organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour there. An Indian laboratory engaged by a UK solicitors' firm to examine a client's devices is a processor under the UK GDPR for that work, and the contract will say so.

The Act's processing regimes decide which rules apply to a given file. General processing covers companies, charities and most public bodies and applies the UK GDPR standards. Law enforcement processing covers the police, prosecutors and other competent authorities when they process for law enforcement purposes; it gives effect to the EU Law Enforcement Directive in UK law and has its own principles, its own rights and its own 72 hour breach reporting rule. A further part covers the intelligence services. A laboratory that takes instructions from a police force is handling law enforcement data; one that takes instructions from the force's insurer is handling general processing data. Ask which before you start, because the exemptions and the rights differ.

A UK controller sending personal data to a laboratory in India needs a lawful transfer mechanism unless the destination is covered by UK adequacy regulations. The Information Commissioner publishes the UK's transfer tools; the client chooses the tool, the laboratory signs it and keeps to it. As with the EU, many clients prefer to keep the image on a UK server and let the examiner work remotely.

The Data (Use and Access) Act 2025 comes into force in stages. The measures most relevant to investigations are recognised legitimate interests (section 70 and Schedule 4); purpose limitation restated (section 71); subject access searches that need only be reasonable and proportionate, with a stop-the-clock provision; the automated decision-making framework (section 80 and Schedule 6); the data protection test for transfers (section 85 and Schedules 7 to 9); the Information Commission (section 117 and Schedule 14, established two months after Royal Assent without functions, with functions transferred separately); interview notices and paid-for technical reports as regulator powers; and alignment of the Privacy and Electronic Communications Regulations' enforcement powers and fines with the 2018 Act. The government publishes the commencement regulations and dates on GOV.UK. Until a provision has commenced the earlier law applies, and a report should cite the version in force on the date of the processing.

Neither instrument licenses covert examination of a person's device. Authority comes from the employer's contract and policies, from consent that is real, or from a court. The law does not stop disclosure to the police where a legal obligation or a lawful request applies, and it does not make a laboratory responsible for the client's decision to investigate. There is no UK GDPR certificate. The Information Commissioner does not certify laboratories, and a consultant who says otherwise is mistaken.

A report for a UK matter states the regime (general or law enforcement processing), the lawful basis the client relied on, the scope and the authorisation, then the method, hashes and findings. It keeps third-party data to the minimum, pseudonymises people who are not the subject and marks criminal offence data as such. It does not include the full extraction, the whole mailbox or speculative profiling of the subject. A separate annex records retention and deletion dates agreed with the client so that the evidence is not kept longer than necessary.