It’s the UK’s version of the General Data Protection Regulation (GDPR) — a law that gives you more control over how companies use your personal data.
👤 What Counts as Personal Data?
Anything that can identify you:
- Name, address, email
- IP address, location
- Photos, biometric data
- Even opinions about you
✅ Your Rights Under the Law
You have the right to:
- Know what data is being collected
- Access your data
- Correct inaccurate info
- Delete your data (“right to be forgotten”)
- Object to how it’s used (like for marketing)
- Move your data elsewhere (data portability)
🏢 What Businesses Must Do
Companies must:
- Get clear consent before collecting data
- Keep it safe and secure
- Only use it for the purpose they told you
- Let you opt out easily
- Report serious data breaches quickly
⚖️ What Happens If They Break the Rules?
They can face big fines — up to £17.5 million or 4% of global turnover, whichever’s higher.
💡 Why It Matters
This law helps protect your privacy in a digital world. It puts you in charge and holds companies accountable.
The Data Protection Act 2018, aligned with GDPR, gives you real power over your personal data. Here’s how it affects your rights in a practical, everyday sense:
🔍 You’re in Control
- Transparency: Companies must tell you what data they’re collecting and why.
- Consent: They can’t just assume you’re okay with it — you must actively agree.
- Access: You can request a copy of your data at any time (called a Subject Access Request).
- Correction: If something’s wrong or outdated, you can demand it be fixed.
- Erasure: You can ask for your data to be deleted — especially if it’s no longer needed.
- Objection: You can say no to your data being used for marketing or profiling.
- Portability: You can move your data between services (like switching banks or email providers).
🛡️ You’re Protected
- Your data must be stored securely.
- If there’s a serious breach, companies must tell you quickly.
- Sensitive data (like health info or biometric data) gets extra protection.
⚖️ You’re Backed by Law
If a company mishandles your data, you can:
- Complain to the Information Commissioner’s Office (ICO)
- Potentially claim compensation
- See the company fined — sometimes millions
In short, this act flips the script: your data isn’t theirs to take — it’s yours to control.
If you believe your personal data has been mishandled or exposed in a breach, here’s how to take action in the UK:
📝 Step-by-Step: Reporting a Data Breach
1. Contact the Organisation First
- Let them know what happened and ask for an explanation.
- They may resolve it quickly or clarify the situation.
2. Escalate to the ICO (Information Commissioner’s Office)
If you’re not satisfied or the breach is serious, report it to the ICO:
- Use the ICO’s online complaint form
- Or call them at 0303 123 1113 (Textphone: 18001 0303 123 1113)
- You can also write to:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
3. What to Include
- Details of the breach (what data, when, how)
- Any communication with the organisation
- How it has affected you (e.g. financial loss, distress)
⚠️ If You’re an Organisation
You must report serious breaches to the ICO within 72 hours of becoming aware of them. If the breach poses a high risk to individuals, you must also inform those affected.
