The DPA 2018 works alongside the UK GDPR.
It supplements the UK GDPR and also contains separate regimes, including law-enforcement and intelligence-services processing. In ordinary consumer disputes it is especially relevant to exemptions and the UK enforcement framework.
Do not cite the Act as though every section creates a standalone consumer remedy.
Identify the actual provision relevant to the right or exemption in issue. Often the operative right is in the UK GDPR and the DPA 2018 changes or limits how that right applies in particular circumstances.
Use current ICO guidance to interpret the practical process.
The ICO updates operational guidance when the law changes. In July 2026 it updated subject-access guidance to reflect the Data (Use and Access) Act 2025 changes.
When an exemption is cited, ask three things.
Exemption test.
What exact DPA provision is relied upon? What category of information/processing does it cover? What facts make the restriction necessary or applicable to this request?
Where only part of the personal data is affected, ask whether the remainder can still be supplied.
The Act has been amended: check the current text.
The Data (Use and Access) Act 2025 amended UK data-protection law, with all of its data-protection provisions in force by 19 June 2026. Use the current legislation and current ICO guidance rather than relying on an older 2018-era summary.
Part 3 covers law-enforcement processing by competent authorities.
Police and other competent authorities can process data under the DPA’s law-enforcement regime rather than the ordinary UK GDPR framework when processing for law-enforcement purposes. Rights and restrictions therefore need to be checked under the correct Part rather than assumed from a standard commercial SAR guide.
For ordinary consumer disputes, the DPA often matters most at the edges of a UK GDPR right.
A person may rely on a UK GDPR right such as access or rectification, while the organisation relies on a DPA 2018 exemption or restriction. That is why a response quoting only “GDPR” can be incomplete. Ask for the exact provision relied upon and how its conditions apply.
The Data Protection Act 2018 does more than “implement GDPR”.
The DPA 2018 sits alongside the UK GDPR and provides UK-specific rules, restrictions, enforcement provisions and exemptions. It also contains distinct regimes for law-enforcement processing by competent authorities and processing by the intelligence services.
Official sources
Check the current source material.
ConsumerWise provides general information rather than individual legal advice. Check current rules, dates and eligibility against the official source before acting.