UK General Data Protection Regulation (UK GDPR): The UK's primary data protection legislation post-Brexit, setting out the key principles, rights and obligations for processing personal data in the UK
Data Protection Act 2018 (DPA 2018): The UK's implementation of data protection legislation that works alongside and supplements the UK GDPR, providing additional local requirements
Privacy and Electronic Communications Regulations 2003 (PECR): Specific rules for electronic communications, including regulations on cookies, electronic marketing, and privacy in electronic communications
Freedom of Information Act 2000: Legislation governing public access to information held by public authorities, which must be considered if the organization is a public body
Environmental Information Regulations 2004: Regulations providing public access to environmental information held by public authorities, relevant if the organization handles environmental data
Computer Misuse Act 1990: Legislation concerning unauthorized access to computer systems and data, relevant for information security aspects of data protection
Human Rights Act 1998: Incorporates fundamental rights from the European Convention on Human Rights, particularly Article 8 regarding the right to privacy
ICO Guidance: Official guidelines and codes of practice from the Information Commissioner's Office, providing practical interpretation of data protection requirements
European Data Protection Board Guidelines: Guidelines that remain relevant post-Brexit as best practice and for organizations dealing with EU-UK data flows
EU GDPR: European Union's data protection regulation that must be considered if the organization processes data of EU residents or operates in the EU
International Data Transfer Requirements: Rules and requirements governing the transfer of personal data outside the UK, including adequacy decisions and appropriate safeguards
