UK GDPR: The UK General Data Protection Regulation - The primary data protection legislation in the UK post-Brexit, setting out the key principles, rights and obligations for processing personal data
Data Protection Act 2018: The UK's implementation of data protection law that works alongside the UK GDPR, providing additional requirements and specifications for data protection in the UK context
PECR 2003: Privacy and Electronic Communications Regulations - Specific rules for electronic communications, including rules on marketing, cookies and electronic communications services
Human Rights Act 1998: Incorporates fundamental rights from the European Convention on Human Rights into UK law, particularly Article 8 regarding the right to privacy
Freedom of Information Act 2000: Legislation governing public access to information held by public authorities, relevant for public sector organizations' privacy notifications
Consumer Rights Act 2015: Legislation protecting consumer rights, which may impact privacy notifications when dealing with consumer personal data
ICO Guidance: Official guidance and codes of practice from the Information Commissioner's Office, the UK's data protection regulator
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice
Transparency Requirements: Specific requirements under Articles 13 and 14 of UK GDPR regarding information that must be provided to data subjects
Data Subject Rights: The rights individuals have over their personal data, including access, rectification, erasure, and data portability
Lawful Processing Bases: The legal grounds under which personal data can be processed, such as consent, contract, legal obligation, legitimate interests
International Transfers: Rules and requirements for transferring personal data outside the UK, including adequate safeguards and transfer mechanisms
Data Retention: Requirements for specifying and adhering to data retention periods in line with data minimization principles
Security Measures: Technical and organizational measures required to ensure appropriate security of personal data
Cookie Compliance: Specific requirements for the use of cookies and similar technologies, including consent and information requirements
Special Category Data: Additional requirements for processing sensitive personal data such as health, biometric, or ethnic origin information
Children's Data Protection: Specific requirements and additional safeguards for processing personal data of children
