UK Data Protection Act 2018 Policies

What is the Data Protection Act 2018?

Quick answer. The Data Protection Act 2018 (DPA 2018) is the UK statute that supplements UK GDPR. It implements the GDPR through Schedule 1, sets out UK-specific exemptions (Schedule 2–4), establishes the Information Commissioner’s powers, and applies the law-enforcement and intelligence-services regimes that GDPR itself does not cover. The DPA 2018 + UK GDPR sit together — you cannot meet one without meeting the other.

The UK Data Protection Act 2018 is the UK's primary data-protection statute, sitting alongside UK GDPR. It does three things: it implements UK GDPR (confirming the ICO as the supervisory authority, converting fines into sterling), it supplements UK GDPR with UK-specific exemptions and conditions (Schedules 1–4), and it introduces additional regimes that UK GDPR doesn't reach — Part 3 for competent authorities processing for law-enforcement purposes, and Part 4 for the intelligence services.

For most UK SMEs, the DPA 2018 pieces that matter are Schedule 1 (conditions for processing special-category and criminal-offence data, including when an Appropriate Policy Document is required), section 170 (criminal offence of unlawfully obtaining personal data), and sections 137–138 (mandatory ICO registration fee).

Who needs DPA 2018 policies?

Quick answer. Every UK organisation processing personal data — identical scope to UK GDPR, which means almost every employer, every B2B SaaS firm, every charity. Specific extra duties apply to law-enforcement processors (Part 3) and intelligence services (Part 4). Children’s services and online providers must additionally observe the Age Appropriate Design Code (Children’s Code).

• UK employers running DBS checks or equality monitoring — relying on Schedule 1 conditions, APD required.
• Healthcare and social-care providers — Article 9 special-category data plus Schedule 1 substantial-public-interest conditions.
• Insurance, pensions and financial services processing medical or criminal-offence data.
• Competent authorities under Part 3 — police, CPS, certain regulatory bodies with investigatory functions.
• Any UK organisation — ICO registration is mandatory under sections 137–138 unless narrowly exempt.

Policies you need for DPA 2018

Quick answer. Same 12-policy backbone as UK GDPR (privacy notice, ROPA, DPIA, DSAR, breach notification, lawful basis register, retention schedule, processor DPA, marketing consent, cookie policy, international transfer, subject-access response templates) plus DPA-specific add-ons where relevant: a special-category-data handling policy, criminal-offence-data conditions, Schedule 2/3 exemption decisions, and (for in-scope firms) a law-enforcement processing addendum.

These 10 policies cover the DPA 2018-specific layer that UK GDPR policies don't reach. They're intended to sit alongside a core UK GDPR pack:

Realistic timeline for DPA 2018 readiness

Quick answer. 2–4 weeks for documentary readiness once policies are drafted. PolicySuite compresses the drafting phase from the traditional 4–8 weeks to 48 hours. Week 1: bespoke policies generated from structured questions. Week 2: ROPA populated, lawful-basis assessments completed. Week 3–4: DSAR and breach workflows embedded operationally; DPA-specific exemptions documented per processing activity.

If you already have a UK GDPR pack, adding DPA 2018-specific documentation is a 1–2 week exercise. From scratch, expect 3–4 weeks to combined readiness.

1. Day 1: Confirm ICO registration tier and pay the fee if not already done.
2. Day 2–3: Buy the pack, receive bespoke policies in 48 hours.
3. Week 2: Map Schedule 1 conditions you rely on; complete the Appropriate Policy Document template.
4. Week 3: Publish/update external privacy notice, distribute internal policies, train staff.
5. Ongoing: Annual APD review, updates when new Schedule 1 conditions come into play.

Policy packs for DPA 2018

PolicySuite vs GRC platforms vs consultant vs DIY

Quick answer. Privacy consultancies charge £3k–£15k for a DPA 2018 / UK GDPR policy set with 4–8 weeks turnaround. OneTrust and similar GRC platforms automate DSAR ticketing but expect bring-your-own policies at £15k–£60k/year. DIY templates rarely capture the Schedule 1–4 exemptions correctly. PolicySuite produces ICO-defensible DPA 2018 policies in 48 hours from £400.

UK SMEs typically compare four routes when sourcing compliance policies. Here's how they stack up on the decisions that matter.

See full head-to-head comparisons →

Further reading

• How to write an Appropriate Policy Document (APD)
• UK GDPR framework guide
• Special-category data under Schedule 1 DPA 2018
• ICO fee tier calculator
• PolicySuite vs Vanta — UK SME comparison

Frequently asked questions

References and primary sources

Quick answer. The framework guidance on this page is reviewed against the primary-source documents below. Each link resolves to an official regulator or standards-body publication so an auditor, procurement reviewer or DPO can verify the alignment without taking the page on trust.

• Data Protection Act 2018 (legislation.gov.uk) — the UK statute text.
• ICO for organisations — guidance, codes and statutory codes of practice.
• ICO enforcement actions — precedent on monetary penalties and undertakings.
• GDPR (EU) 2016/679 — the EU regulation that the UK GDPR mirrors post-Brexit.

In our experience working with UK SMEs and similar organisations across the EU and US, the framework pages that survive enterprise vendor reviews are the ones that cite primary sources rather than secondary blog posts. Many UK SMEs typically discover this only after their first failed vendor questionnaire — the reviewer asked for a clause-to-source map and the standard reply pointed at a marketing page rather than the relevant regulator. The references above are the standing set we cite from inside the policies themselves so the chain stays intact end-to-end.