UK GDPR: Primary legislation governing data protection in the UK post-Brexit, setting out fundamental principles for data processing, including requirements for Data Protection Impact Assessments under Article 35
Data Protection Act 2018: The UK's implementation of data protection legislation that works alongside UK GDPR, providing specific requirements for data protection in the UK context
PECR 2003: Privacy and Electronic Communications Regulations governing electronic communications, relevant for DPIAs involving electronic marketing, cookies, or electronic communications services
ICO DPIA Guidance: Regulatory guidance from the Information Commissioner's Office specifically relating to when and how to conduct Data Protection Impact Assessments
EDPB Guidelines: European Data Protection Board guidelines that remain relevant post-Brexit as interpretative guidance for DPIA requirements and best practices
Human Rights Act 1998: Legislation incorporating European Convention rights into UK law, particularly Article 8 regarding the right to privacy and family life
Common Law Duty of Confidentiality: Legal principle requiring information shared in confidence to be protected from unauthorized disclosure, relevant for DPIAs involving confidential information
Article 35 Requirements: Specific section of UK GDPR mandating when DPIAs are required, particularly for high-risk processing activities
ICO Screening Checklist: Official checklist provided by the ICO to help organizations determine whether a DPIA is necessary for their processing activities
Cross-border Transfer Requirements: Specific requirements under UK GDPR for international data transfers that must be considered in DPIAs involving data transfers outside the UK
Information Security Requirements: Technical and organizational security measures required under UK GDPR that must be assessed as part of the DPIA process
