Data Protection Act 2018
The Data Protection Act 2018 is the UK’s principal data protection statute. It does not stand alone: it operates alongside the UK GDPR, supplementing it with the detail the regulation leaves to national law — exemptions, law enforcement and intelligence processing, and the powers of the Information Commissioner.
Reading either document in isolation gives an incomplete answer. UK data protection law is the two together, as amended by the Data (Use and Access) Act 2025.
| In force | 25 May 2018, alongside the GDPR |
| Now read with | UK GDPR, and the Data (Use and Access) Act 2025 |
| Regulator | Information Commissioner’s Office (ICO) |
| Maximum fine | £17.5 million or 4% of global annual turnover, whichever is higher |
| Biometric data | Special category data where used to identify a person |
| 2025 change most relevant here | A recognised legitimate interest for fraud prevention |
How the DPA 2018 and UK GDPR fit together
The GDPR was designed to leave specified matters to member states. The DPA 2018 is where the UK made those choices, and it also carries material the GDPR does not cover at all.
- Exemptions and conditions — including the conditions for processing special category and criminal offence data, which is where much of the practical detail for regulated firms sits.
- Law enforcement processing, under a separate part with its own rules.
- Intelligence services processing, under another.
- The ICO’s powers, and the offences created in UK law.
After Brexit the EU GDPR was retained in domestic law as the UK GDPR, so the structure survived rather than being replaced. The UK currently holds an EU adequacy decision, which is what allows personal data to flow from the EU to the UK without additional safeguards — and preserving it was an explicit constraint on how far the 2025 reforms could go.
What the Data (Use and Access) Act 2025 changed
The DUAA received Royal Assent on 19 June 2025 and amends the UK GDPR, the DPA 2018 and the e-privacy regulations. Its provisions are being commenced in stages through secondary legislation. Three changes matter for fraud and identity work.
Recognised legitimate interests. The Act introduces a category of processing that is treated as lawful without the controller having to carry out the usual legitimate interests balancing test — and fraud detection and prevention is on that list, alongside information security, crime prevention and public safety. This does not remove the other obligations, and it does simplify the lawful basis analysis for a purpose that previously required firms to document a balancing exercise for every deployment.
Automated decision-making. The restrictions are relaxed, permitting automated decisions in a wider range of circumstances provided there is transparency, a route to meaningful human intervention, and an accessible way for a person to contest the outcome. For automated onboarding and fraud decisioning this is a material loosening, with conditions attached that have to be built rather than assumed.
International transfers. A new data protection test asks whether the standard in the destination is not materially lower than the UK standard, replacing the stricter essentially-equivalent formulation.
Why it matters for identity verification
Identity verification under UK law involves two categories of data with different rules, and conflating them is the most common mistake.
Name, date of birth and document number are ordinary personal data. A facial biometric used to identify a person is special category data, which cannot be processed without both a lawful basis and a separate condition from Article 9 or the DPA 2018’s conditions. Capturing a document image and a selfie therefore engages two regimes in one flow.
The DUAA’s recognised legitimate interest is useful here and narrower than it first appears: it settles the lawful basis question for fraud prevention processing, and it does not by itself supply the special category condition for biometric processing. That still has to be established, usually through substantial public interest grounds or the conditions in the DPA 2018.
Two practical implications follow. Data minimization is the strongest control available — extracting the attributes needed and not retaining the document image reduces exposure under both regimes at once, which is part of why on-device processing is a compliance choice rather than only a performance one. And the relaxed automated decision-making rules come with conditions: a fully automated decline needs a real route to human review and a way for the person to challenge it, built into the process rather than promised in a policy.
UK and EU regimes compared
| United Kingdom | European Union | |
|---|---|---|
| Core instruments | UK GDPR + DPA 2018, as amended by DUAA 2025 | GDPR |
| Regulator | ICO | National supervisory authorities, with the EDPB |
| Maximum fine | £17.5m or 4% of turnover | €20m or 4% of turnover |
| Fraud prevention basis | Recognised legitimate interest — no balancing test | Legitimate interests, balancing test required |
| Automated decisions | Relaxed, with safeguards | Article 22 restrictions apply |
| Transfers out | Not materially lower standard | Essentially equivalent standard |
The divergence is real but deliberately bounded. Each change was calibrated against the risk to EU adequacy, which the UK needs and which is periodically reviewed.
What the DPA 2018 does not do
It does not replace the UK GDPR. They are read together, and an answer drawn from only one is usually incomplete.
It does not override retention duties elsewhere. Identity records kept under money laundering regulations are retained because another statute requires it; an erasure request does not defeat that, though it does not extend to data held beyond the required period either.
It does not make automated decisions unrestricted. The DUAA relaxed the rules and attached conditions — transparency, human intervention, contestability — which are obligations rather than aspirations.
It does not apply to the EU. A UK firm serving EU customers is subject to the EU GDPR for that processing, and the two regimes have now diverged enough that one compliance program no longer covers both without checking.
Frequently asked questions
What is the difference between the Data Protection Act 2018 and UK GDPR?
They work together. UK GDPR sets the main framework; the DPA 2018 supplements it with the detail left to national law — exemptions, conditions for special category and criminal offence data, law enforcement and intelligence processing, and the ICO’s powers. Neither gives a complete answer alone.
Did the Data (Use and Access) Act 2025 replace the DPA 2018?
No. It amends the existing framework rather than replacing it. The UK GDPR and DPA 2018 remain in force as amended, with the DUAA’s provisions commenced in stages through secondary legislation.
Is fraud prevention a lawful basis under UK law now?
Fraud detection and prevention is a recognised legitimate interest under the DUAA, which means the usual balancing test is not required for that purpose. The other obligations still apply, and biometric processing still needs a separate special category condition.
Is biometric data special category data in the UK?
When it is processed for the purpose of uniquely identifying a person, yes. That requires a lawful basis plus a separate Article 9 or DPA 2018 condition. Biometric data not used for identification may fall outside the special category definition, so the purpose determines the treatment.
Related reading
- GDPR — the EU regime the UK framework derives from
- California Consumer Privacy Act — the US state comparison
- Personally identifiable information — what counts as personal data
- On-device processing — minimizing what is collected in the first place
