UK GDPR: The UK General Data Protection Regulation - The primary data protection legislation in the UK post-Brexit, setting out fundamental rights and obligations for personal data processing
DPA 2018: Data Protection Act 2018 - The UK's implementation of data protection law, complementing and supplementing the UK GDPR
PECR: Privacy and Electronic Communications Regulations 2003 - Specific rules for electronic communications, including rules on cookies, marketing, and privacy in telecommunications
Human Rights Act 1998: Incorporates Article 8 (Right to Privacy) of the European Convention on Human Rights into UK law, establishing fundamental privacy rights
Freedom of Information Act 2000: Legislation governing public access to information held by public authorities, with implications for privacy and data protection
Computer Misuse Act 1990: Legislation addressing unauthorized access to computer systems and data, relevant for data security provisions
Common Law Duty of Confidentiality: Legal principle requiring information shared in confidence to be protected and not disclosed without permission
ICO Guidelines: Regulatory guidance and codes of practice issued by the Information Commissioner's Office for data protection compliance
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice
Data Protection Principles: Core principles including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality
Data Subject Rights: Rights granted to individuals including access, rectification, erasure, portability, and objection to processing
International Data Transfers: Rules and requirements for transferring personal data outside the UK, including adequate safeguards and transfer mechanisms
Data Security Measures: Technical and organizational measures required to ensure appropriate security of personal data
Breach Notification Procedures: Requirements for reporting and handling personal data breaches, including notification timelines and procedures
Data Retention Requirements: Rules and principles governing how long personal data can be retained and when it must be deleted
