Data Protection Act

The Data Protection Act 2018 is the UK law that controls how personal data — information that can identify a living person — is collected, stored, used and shared.

It applies to any organisation that handles personal data: shops, schools, hospitals, charities and even small local clubs. If an organisation keeps your details, the Act makes it responsible for them and for using them only in ways the law allows. It covers details held on a computer and details written down on paper.

Why the Act exists

Organisations genuinely need personal data — a swimming club needs your mobile number to tell you a session has been cancelled. Without rules, though, that information could be passed on to other companies, left on a lost laptop or used to pester you. The Act balances both sides: organisations can still collect and use data, but the people the data is about keep control over it.

That makes the Act a legal issue rather than just a matter of good manners. An organisation that ignores it is breaking the law, so data protection shapes real decisions about what a company collects, how long it keeps it and who it shares it with. The principles set out how organisations must behave, and your data rights set out the control you keep as an individual.

A worked example

A bike repair shop writes down your name, mobile number and address when you drop off a bike. Under the Act the shop must look after those details carefully, use them to repair and return your bike, and keep them no longer than it needs them. Selling your address to a marketing company because it was useful would be against the law, because the shop may only use your details for the purpose you gave them for.