GDPR or Data Protection Act?

[Gongalong]

Hi folks,

 

Am I right in thinking that the law that applies to data protection in the UK is actually the Data Protection Act 2018, rather than the General Data Protection Regulation? A lot of folks tend to refer to data protection as GDPR, and I appreciate that's the EU wide guidance, but as I have to put this into some training I would like to use the correct legislation that applies in the UK.

 

Thanks

[3s-gtech]

Yes, DPA. GDPR was adopted into UK law as the Data Protection Act 2018. Either is correct to an extent, but DPA is more so.

[GrumbleDook]

If refering to the UK, it is common to say DPA18 and UK-GDPR.

[Gongalong]

As I was on a call to the ICO helpline about something else I asked them this question. The law that applies is both the data protection act *and* the UK GDPR https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/

[GrumbleDook]

40 minutes ago, Gongalong said:

As I was on a call to the ICO helpline about something else I asked them this question. The law that applies is both the data protection act *and* the UK GDPR https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/

GDPR is the regulation, the DPA is how that regulation is enacted within law, including where it needs to make specific references to other legislation on the books or relies on other regulatory guidance or instructions, including instructions from the relevant Secretary of State and/or supervisory authority (I.e. the ICO).

[Gongalong]

The ICO seemed to be saying there were different elements in both bits of legislation, and I heard something along those lines in a briefing from a county legal team as well today. Although I'm not sure I'm going to try reading both to check!

[GrumbleDook]

Yes, there are differences in them. DPA2018 also covers law enforcement as well, and does not cover some of the detail that GDPR does. We also need to remember that GDPR is written to be both stand alone, and to fit around other EU Regulations and Directives. 

And now we have to go through it all again and see what the new Act will do.