UK GDPR: The UK General Data Protection Regulation - the primary legislation governing personal data processing in the UK post-Brexit, setting out core principles for data protection and individual rights
DPA 2018: The Data Protection Act 2018 - supplements the UK GDPR and provides specific data protection requirements for UK organizations
PECR 2003: Privacy and Electronic Communications Regulations 2003 - specific rules for electronic communications, cookies, and direct marketing
Human Rights Act 1998: Incorporates European Convention rights into UK law, particularly Article 8 regarding the right to privacy and family life
Freedom of Information Act 2000: Relevant when one party is a public authority, governing public access to information held by public authorities
Common Law Duty of Confidentiality: Legal principle requiring information shared in confidence to be protected and not disclosed without permission
ICO Guidance: Guidelines and codes of practice issued by the Information Commissioner's Office, the UK's data protection regulator
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice
Data Protection Principles: Core principles under UK GDPR including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality
Lawful Bases: Legal grounds for processing personal data under UK GDPR including consent, contract, legal obligation, vital interests, public task, and legitimate interests
Data Subject Rights: Individual rights including access, rectification, erasure, restriction, portability, and objection to processing
International Transfer Rules: Requirements for transferring personal data outside the UK, including adequacy decisions and appropriate safeguards
Security Requirements: Technical and organizational measures required to ensure appropriate security of personal data
Breach Notification: Obligations to report personal data breaches to the ICO and affected individuals within specified timeframes
Record Keeping: Requirements to maintain records of processing activities and demonstrate compliance with data protection principles
DPIA Requirements: Data Protection Impact Assessment obligations for high-risk processing activities
