UK GDPR: The UK General Data Protection Regulation - The primary data protection legislation in the UK post-Brexit, setting out the key principles, rights and obligations for processing personal data
Data Protection Act 2018: The UK's implementation of data protection laws, working alongside and supplementing the UK GDPR, providing specific data protection requirements and derogations
PECR 2003: Privacy and Electronic Communications Regulations - Specific rules for electronic communications, including rules on marketing, cookies and electronic communications services
Freedom of Information Act 2000: Legislation giving public access to information held by public authorities, relevant if the organization is a public body
Human Rights Act 1998: Incorporates European Convention rights into UK law, specifically Article 8 which provides the right to respect for private and family life
ICO Guidelines: Official guidance and codes of practice from the Information Commissioner's Office, the UK's data protection regulator
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice
Financial Services and Markets Act 2000: Sector-specific legislation containing additional privacy and data handling requirements for financial services organizations
Health and Social Care Act 2012: Sector-specific legislation containing additional privacy and data handling requirements for healthcare providers
Children's Code: Age Appropriate Design Code providing standards for online services likely to be accessed by children
EU GDPR: The EU General Data Protection Regulation - Relevant if the organization serves EU customers or processes EU citizens' data
International Data Transfer Requirements: Rules and requirements governing the transfer of personal data outside the UK, including adequacy decisions and appropriate safeguards
