UK GDPR: The UK General Data Protection Regulation - primary legislation governing data protection in the UK post-Brexit, setting out fundamental principles for data processing
DPA 2018: Data Protection Act 2018 - the UK's implementation of data protection law, working alongside and supplementing the UK GDPR
PECR: Privacy and Electronic Communications Regulations 2003 - specific rules for electronic communications, including electronic marketing and cookies
ICO Guidance: Information Commissioner's Office guidance and codes of practice - authoritative interpretation and practical guidance on applying data protection law
EDPB Guidelines: European Data Protection Board guidelines - while not binding post-Brexit, remain influential for UK data protection practice and interpretation
Article 28 Requirements: Specific requirements under UK GDPR Article 28 for data processing agreements, including mandatory contractual terms
International Transfer Rules: Requirements for transferring personal data outside the UK, including adequacy decisions and appropriate safeguards
Security Requirements: Data security obligations under Article 32 UK GDPR, including technical and organizational measures
Breach Notification: Obligations to notify data controllers and/or authorities of personal data breaches within specified timeframes
Sub-processing Rules: Requirements for appointing and managing sub-processors, including obtaining necessary authorizations
Data Subject Rights: Obligations to assist controllers in responding to data subject rights requests under UK GDPR
Record Keeping: Requirements to maintain records of processing activities and demonstrate compliance with data protection principles
