UK GDPR: The UK General Data Protection Regulation - Primary legislation governing data protection in the UK post-Brexit, setting out fundamental principles for personal data processing
DPA 2018: Data Protection Act 2018 - The UK's implementation of data protection laws, complementing and working alongside the UK GDPR
PECR 2003: Privacy and Electronic Communications Regulations 2003 - Specific rules for electronic communications, including rules about cookies, marketing calls, emails and texts
Freedom of Information Act 2000: Legislation providing public access to information held by public authorities, relevant if the organization is a public body
Human Rights Act 1998: Particularly Article 8 which enshrines the right to respect for private and family life, home and correspondence
ICO Guidance: Official guidance documents from the Information Commissioner's Office, providing practical interpretation of data protection requirements
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice
Data Protection Principles: Seven key principles under UK GDPR Article 5 including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, and storage limitation
Lawful Bases: Six legal bases for processing under UK GDPR Article 6: consent, contract, legal obligation, vital interests, public task, and legitimate interests
Special Category Data: Additional requirements under Article 9 for processing sensitive personal data such as health, racial, religious, or biometric information
Individual Rights: Rights granted to individuals including access, rectification, erasure, portability, and objection to processing
International Transfers: Requirements and safeguards for transferring personal data outside the UK, including adequacy decisions and appropriate safeguards
Data Security: Technical and organizational measures required to ensure appropriate security of personal data
Retention Periods: Requirements for establishing and documenting how long personal data will be kept and justification for retention periods
Complaints Procedure: Process for handling data protection related complaints and individuals' right to lodge complaints with the ICO
