Data Protection Act 2018

Yes.

The only thing I can't fit into GDPR or the Data Protection Act is psychometric testing on employees.

There is absolutely no lawful basis under which you can do it.

Consent?

What? I want a copy of the data.

The Data Protection Act requires you to have a procedure in place for anybody who requests a copy of the data that you hold on them.

We have a procedure in place.

Would you like to see the procedure? Yeah.

Now, the other bit of news in this area this week, the Comms Council UK, or the CCUK, in collaboration with Ofcom, the Home Office, and the ICO, that's the Information Commissioner's Office, has published joint guidance titled Sharing Data to Tackle Fraud, Guidance for Telecoms Providers, and that is designed to establish clear mechanisms for intelligence sharing across the UK communications sector.

Designed for providers of all sizes, the guidance addresses common regulatory misconceptions by emphasising that UK data protection laws including the UK GDPR, the Data Protection Act 2018 and the Data Use and Access Act 2025 do not constitute a default barrier to sharing information as crime prevention is explicitly recognised as a legitimate interest.

publication provides practical decision flowcharts, proportionality tests and operational due diligence expectations designed to encourage providers proactively to share minimised fraud data with law enforcement, financial institutions and specified anti-fraud organisations such as CFAS and the TUFF.

Now let's turn our attention to some market abuse news.

Now, what they'd actually written was the Data Protection Act 1998, which obviously doesn't exist apart from one bit.

Um, but the link did go through to Data Protection Act 2018, but it went through to Part 3, which is law enforcement, which the NHS is not a competent authority.

Yeah.

So it's that sort of stuff.

So we're going to talk about UK data protection law for overseas businesses expanding into the UK.

So that means it's the UK GDPR, which is the UK's own version of the European Union's GDPR piece of legislation, but then also the UK Data Protection Act, which supplements the GDPR.

And then also some specific rules around cookies and electronic marketing, which are found in what's called the e-privacy legislation.

So this is a package of legislation that comprises UK data protection law.