Data Protection Act 2018, section 2

Protection of personal data

PART 1 Preliminary

(1)The [F6UK GDPRF6] and this Act protect individuals with regard to the processing of personal data, in particular by—

(a)requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,

(b)conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and

(c)conferring functions on the [F7Commission, giving itF7] responsibility for monitoring and enforcing their provisions.

F8(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Definitions used in section 2 1

inaccurate

“inaccurate”, in relation to personal data, means incorrect or misleading as to any matter of fact;

Defined in s.205(1) · see it in the full Act

Cases considering section 2 5

Ben Peter Delo, R (on the application of) v The Information Commissioner & Anor

[2022] EWHC 3046 (Admin) · 2 December 2022Interprets

Confirms the statutory objectives of protecting individuals in relation to personal-data processing and conferring monitoring and enforcement functions on the Commissioner. Interprets the provision as requiring the Commissioner, when exercising functions, to balance the protection of personal data with the interests of data subjects, controllers and others and the public interest.

Yesim Kul & Ors v DWF Law LLP

[2025] EWHC 1824 (KB) · 22 July 2025

Confirms that administration of justice may constitute processing in the public interest for article 6(1)(e) purposes.

Dale Vince v Associated Newspapers Limited

[2025] EWHC 1411 (KB) · 9 June 2025

Confirms that the public-interest balance relevant to data protection includes matters of general public interest to which the Information Commissioner must have regard. The judgment uses this as part of the objective and contextual assessment of fairness. (see para [37])

What each judgment says about section 2 is in the case-law panel in the full Act.

Amendments and notes

4 notes from legislation.gov.uk

Amendments

  1. F6Words in s. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 3 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F7Words in s. 2(1)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(4); S.I. 2026/1015, reg. 2(c)
  3. F8S. 2(2) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 91(2), 142(1); S.I. 2025/904, reg. 2(e)

Commencement

  1. I2S. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(a)