The UK is a party to the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data", which became open for signature in 1981. Parliament passed the Data Protection Act 1984 to ensure compliance with the standards set out in the Convention and ratified the Convention in 1985.
	The Data Protection Act 1984 was repealed and replaced by the Data Protection Act 1998, which implemented the EU Data Protection Directive (95/46/EC) ("the 1995 Directive").
	The 1995 Directive was replaced by the EU General Data Protection Regulation (2016/679) (the "EU GDPR"), which applied directly in the UK from 25 May 2018. This was supplemented in the UK by the Data Protection Act 2018 (DPA 2018), in particular Part 2 of the Act, which repealed the Data Protection Act 1998 and exercised derogations provided by the EU GDPR.
	The EU GDPR does not apply to processing by competent authorities for law enforcement purposes. Such processing was subject to EU Directive 2016/680 1 , which was transposed into UK law in DPA 2018 (in particular in Part 3 of the Act).
	The DPA 2018 provides for a further processing regime for processing by the Intelligence Services (in Part 4 of the Act).
	The EU GDPR was incorporated into UK law at the end of the EU Transition Period under section 3 of the European Union (Withdrawal) Act 2018 (EUWA 2018) and modified by the Data Protection, Privacy and Electronic Communication (Amendments etc) (EU Exit) Regulations 2019 under the power in section 8 EUWA 2018 to create the UK GDPR.
	The UK’s data protection framework therefore comprises three regulatory regimes:
General processing of personal data - governed by the UK GDPR as supplemented by Part 2 of the DPA 2018;
Processing by "competent authorities" (as defined in section 30 & schedule 7 DPA 2018) for law enforcement purposes - governed by Part 3 DPA 2018; and
Processing by the UK intelligence services - governed by Part 4 DPA 2018.
	Part 5 DPA 2018 sets matters concerning the constitution, functions, powers and duties of the Information Commissioner. Part 6 sets out enforcement procedures.
Data Protection