Data Protection Act 2018

In short

This law, the Data Protection Act 2018, establishes the Data Protection Commission and outlines rules for processing personal data, including special categories of data, to protect individuals' privacy rights.

What it regulates

• The establishment and functions of the Data Protection Commission as a supervisory authority.
• Rules for processing personal data, including specific provisions for children and special categories of data.
• The rights of individuals regarding their personal data and restrictions on those rights in certain circumstances.
• Enforcement mechanisms, including investigations, administrative fines, and judicial remedies for infringements.

Who it concerns

• The Data Protection Commission and its staff.
• Organisations and individuals who process personal data (controllers and processors).
• Individuals whose personal data is being processed (data subjects).

Key points

• Establishes the Data Protection Commission (Part 2).
• Includes specific rules for children's data, such as consent for information society services (Section 31) and the right to be forgotten (Section 33).
• Outlines conditions for processing special categories of personal data, including for employment, legal advice, and public health (Chapter 2 of Part 3).
• Details enforcement powers of the Commission, including the ability to impose administrative fines (Chapter 6 of Part 6).