2018 c. 12 · Last verified
Data Protection Act 2018
The Data Protection Act 2018 (2018 c. 12) sits alongside the UK GDPR; s.207 scope and the s.157 penalty maximums are reproduced verbatim here. Given Royal Assent on 23 May 2018, it is reproduced here in its own wording, with section numbers and links to the official revised text — this page does not interpret it or assess applicability.
- Citation
- 2018 c. 12
- Jurisdiction
- GB
- Regulator
- Information Commissioner's Office (ICO)
- Last verified
What it is
Given Royal Assent on 23 May 2018, it is reproduced here in its own wording, with section numbers and links to the official revised text — this page does not interpret it or assess applicability.
Key dates
- Royal Assent: —
legislation.gov.uk enacted introduction: 23rd May 2018
Scope
Section 207 — Territorial application (revised text; subsections (3) and (6) are omitted provisions — read the full section at the source)
(1) This Act applies only to processing of personal data described in subsections (1A) and (2).
(1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.
(2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
legislation.gov.uk — Data Protection Act 2018, s.207 (revised text) ↗
Penalties
Section 157(5) (revised text)
The “higher maximum amount” is— (a) in the case of an undertaking, £17,500,000 or 4% of the undertaking’s total annual worldwide turnover in the preceding financial year, whichever is higher, or (b) in any other case, £17,500,000.
Section 157(6) (revised text)
The “standard maximum amount” is— (a) in the case of an undertaking, £8,700,000 or 2% of the undertaking’s total annual worldwide turnover in the preceding financial year, whichever is higher, or (b) in any other case, £8,700,000.
How UK GDPR infringements are capped
Section 157(1)
In relation to an infringement of a provision of the UK GDPR, the maximum amount of the penalty that may be imposed by a penalty notice is— (a) the amount specified in Article 83 of the UK GDPR, or (b) if an amount is not specified there, the standard maximum amount.
The Act and the UK GDPR are named as separate instruments
Section 3(9) (paragraphs (b) and (e) are omitted provisions — read the full section at the source)
“The data protection legislation” means— (a) the UK GDPR, (c) this Act, and (d) regulations made under this Act or the UK GDPR
Pending changes
The Data (Use and Access) Act 2025 (c. 18) amends this Act in stages; the contents page notes changes not yet in force, including the omission of s.114 ("There is to continue to be an Information Commissioner") by 2025 c. 18 s.118(4) with commencement not yet appointed, alongside S.I. 2026/386's transitional provision for the first chair of the Information Commission.
Sources
Last verified:
This page is for information only and is not legal advice. It reproduces the regulation's own wording; always confirm against the primary source linked above and consult qualified counsel for how it applies to your organisation.