GDPR

GDPR stands for the General Data Protection Regulation: a set of rules setting out how organisations must collect, store and use personal data. The rules were written by the European Union, but in the UK the GDPR was incorporated into the Data Protection Act 2018. Its rules were written into that Act, so the Data Protection Act 2018 is the UK law that contains them and makes organisations follow them.

One set of rules, two names

The GDPR and the Data Protection Act 2018 are not two separate laws making different demands. Because the GDPR's rules now live inside the Act, you can describe the same requirements using either name: the Act is simply where those rules are written into UK law.

For example, a climbing centre stores members' names, ages and parents' phone numbers so staff can contact someone quickly after an accident. Those records are covered by the Data Protection Act 2018, and the rules the centre has to follow are the GDPR rules that the Act contains. That is why the Data Protection Act 2018 is the law controlling how personal data is handled in the UK, and the GDPR is where those rules came from.