Data Protection Act 2018, section 3

Terms relating to the processing of personal data

PART 1 Preliminary

(1)This section defines some terms used in this Act.

(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)an identifier such as a name, an identification number, location data or an online identifier, or

(b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—

(a)collection, recording, organisation, structuring or storage,

(b)adaptation or alteration,

(c)retrieval, consultation or use,

(d)disclosure by transmission, dissemination or otherwise making available,

(e)alignment or combination, or

(f)restriction, erasure or destruction,

(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.

(6) F9,F9 “Controller” and “processor”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).

(7) “Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.

F10(8). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F11 (8A) “The Commission” means the Information Commission (see section 114A). F11]

(9) “The data protection legislation” means—

[F12 (a)the UK GDPR,F12]

F13(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)this Act, [F14andF14]

(d)F16regulations made under this Act [F15or the UK GDPRF15] , ...

F16(e). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(10) “[F17 The UK GDPR F17]” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [F18 (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)) F18] .

[F19 (10A) “The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law. F19]

F20(11). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(12) “The Law Enforcement Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

(13) “The Data Protection Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.

(14)In Parts 5 to 7, except where otherwise provided—

[F21 (a)references to the UK GDPR are to the UK GDPR read with Part 2;F21]

F22(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)F23references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies;

(d)F24references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies.

(15)There is an index of defined expressions in section 206.

Cases considering section 3 17

Michael Farley & Anor v Paymaster (1836) Limited (trading as Equiniti)

[2025] EWCA Civ 1117 · 22 August 2025

The statutory definition of personal data was materially identical to Article 4(1). The information in issue plainly fell within it (see para [34]). The statutory definition of processing was materially identical to Article 4(2). It supported the conclusion that the pleaded and admitted operations were processing (see paras [35]-[39]).

CX1 & Ors, R (on the application of) v Secretary of State for Defence & Anor

[2024] EWHC 892 (Admin) · 19 April 2024Defines

Applies the statutory definition of personal data to the leaked dataset. The court concluded that the dataset comprised personal data for the purposes of the alleged data-protection breach. (see para [45]) The court refers to subsection 3(3) together with section 3(2) in identifying the leaked information as personal data for the purposes of the alleged breach. (see para [45])

Angela Powell v Information Commissioner

[2023] UKUT 221 (AAC) · 7 September 2023Defines

Section 3 provides a binary test: information is personal data if a living individual can be identified directly or indirectly. The test is applied using information and means reasonably likely to be used (see paras [23]-[25]; [33]-[37]).

What each judgment says about section 3 is in the case-law panel in the full Act.

Amendments and notes

16 notes from legislation.gov.uk

Amendments

  1. F9Words in s. 3(6) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F10S. 3(8) omitted (30.9.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 118(3), 142(1); S.I. 2026/1015, reg. 2(b) (with reg. 3)
  3. F11S. 3(8A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 117(3), 142(1); S.I. 2025/904, reg. 2(r)
  4. F12S. 3(9)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F13S. 3(9)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F14Word in s. 3(9)(c) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 14(a); S.I. 2025/904, reg. 2(y)
  7. F16S. 3(9)(e) and word omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 14(b); S.I. 2025/904, reg. 2(y)
  8. F15Words in s. 3(9)(d) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 107(2), 142(1); S.I. 2025/904, reg. 2(l)
  9. F17Words in s. 3(10) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  10. F18Words in s. 3(10) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  11. F19S. 3(10A) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  12. F20S. 3(11) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  13. F21S. 3(14)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  14. F22S. 3(14)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  15. F23Words in s. 3(14)(c) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  16. F24Words in s. 3(14)(d) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 4(7)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)