Policy background
Data protection is needed to protect "personal data" which comprises data which relates to a living individual who can be identified from that data. The previous law on data protection was found in the Data Protection Act 1998 ("the 1998 Act"), which regulated the processing of personal data. The 1998 Act protected the rights of individuals to whom the data related.
	The new Act replaces the 1998 Act to provide a comprehensive legal framework for data protection in the UK, in accordance with the General Data Protection Regulation ((EU) 2016/679) ("GDPR"). It updates the rights provided for in the 1998 Act to make them easier to exercise and to ensure they continue to be relevant with the advent of more advanced data processing methods.
	The Act implements commitments to update data protection laws made in the 2017 Conservative Manifesto and modernises data protection laws in the UK to meet the needs of our increasingly digital economy and society.
	Personal data is increasingly stored, processed and exchanged on the internet and as such often exists in an international environment. It is therefore necessary for data protection standards to be consistent at an international level. The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention 108") was signed by the UK on 14 May 1981. The Convention is open for all countries to sign, including states that are not members of the Council of Europe. On 1 November 2017, Tunisia became the 51st Party to the Convention. The Committee of Ministers of the Council of Europe adopted a modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data ("modernised Convention 108") on 18 May 2018. The modernised treaty will be opened for signature on 25 June 2018. The Act has been designed so as to be consistent with the modernised Convention 108.
	The UK’s data protection laws, therefore, need to interlock with international data protection arrangements. In addition to Convention 108, the 1998 Act implemented the European Data Protection Directive (Directive 95/46/EC) ("the 1995 Directive"). On 25 May 2018 the Directive will be replaced when the GDPR begins to apply.
	While the UK remains a member of the EU, all the rights and obligations of EU membership remain in force. When the UK leaves the EU, the GDPR will be incorporated into the UK’s domestic law under the European Union (Withdrawal) Bill, currently before Parliament.
	On 24 August 2017 the Government published ‘The exchange and protection of personal data – a future partnership paper’ setting out why the free flow of data is essential to the UK in future trading relationships.
	The Act is structured in seven parts. Part 1 contains preliminary matters. Part 2 must be read alongside the GDPR and sets out certain derogations from the GDPR. This Part also contains provision extending the GDPR standards to areas outside EU competence (the "applied GDPR" scheme), with the exception of law enforcement and processing by the intelligence services. Part 3 contains provision for law enforcement data processing and Part 4 provides likewise for data processing by the intelligence services. The remaining parts are concerned with the Information Commissioner (the "Commissioner"), enforcement and offences, and supplementary provision.