What this covers
Why you need it
Parliament created it. The power to require it comes from Data Protection Act 2018.
What the Act carries
What our graph holds for Data Protection Act 2018 as a whole — the Act behind this licence, not the licence conditions themselves.
- Duties on businesses
- 65
- Penalties
- 66
- Exemptions
- 40
Duties on businesses under the Act
- Process personal data lawfully, fairly, and transparently s.2
- Include specific legal rights statement when responding to data requests s.13
- Comply with data protection principles and prove it s.34
- Use law enforcement data only for specified and compatible purposes s.36
- Ensure law enforcement data is adequate, relevant, and not excessive s.37
- Maintain accurate law enforcement data and verify its quality s.38
… and 59 more business duties in the same Act.
What happens if you get it wrong
- Alter data to block a data subject’s access request 2 years imprisonment
- Destroy or falsify information after an ICO notice 2 years imprisonment
- Make false statement in response to interview notice 2 years imprisonment
- Obstruct or fail to assist the ICO’s inspection powers 2 years imprisonment
- Re‑identify de‑identified personal data without consent 2 years imprisonment
… and 61 more penalties in the same Act.
Exemptions that may take you outside it
- Access to further data protection exemptions via Schedule 11 — Processing falls within the specific categories listed in Schedule 11 (e.g., related to legal advice, crime prevention, or corporate finance)
- Data protection rights override other laws restricting disclosure — An enactment or rule of law prohibits or restricts the disclosure of information
- Data protection rules take precedence over laws passed after August 2025 — Enactments passed or made on or after 20th August 2025
- Exemption for data processing covered by national security designations — Processing to which Part 4 applies by virtue of a designation notice
- Exemption for data processing related to national security and defence — Processing personal data for safeguarding national security or for defence purposes
… and 35 more exemptions in the same Act.
Read our full dossier on Data Protection Act 2018
Who issues it
This one does not go to your council. It is issued by Department for Science, Innovation and Technology.
Where to apply
Duty, penalty and exemption labels are Guvnor’s analysis of the enabling instrument, not the instrument itself. Fees, forms and conditions are set by the issuing authority — always check the linked source.