Secordit home
Contact

What is UK GDPR?

The UK GDPR and the Data Protection Act 2018 govern how personal data is used in the UK. GOV.UK is the plain starting point, and the ICO is the regulator. Anyone responsible for using personal data must follow the data protection principles, unless an exemption applies. This entry is general information, not legal advice. 1234

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Personal data must be used fairly, lawfully and transparently, and for specified, explicit purposes. 13
  2. It must be adequate, relevant and limited, accurate and kept up to date where necessary, kept no longer than necessary, and handled with appropriate security. 13
  3. People have rights, with some exceptions. These include being informed, accessing their data, having incorrect data updated, and in some cases having data erased. 15

How it can look

GOV.UK says that if you are concerned about how an organisation is handling your personal data, you can contact the ICO. It lists 0303 123 1113. That is not a substitute for a solicitor. Some ICO materials, including encryption guidance, note that they are under review because of the Data (Use and Access) Act. This page explains UK data protection in outline. It is not a guide to that Act. 152

Warning signs

  • An organisation will not say how it uses your personal data, or keeps using it after you have asked a reasonable question. 15
  • A message claims to be from the ICO and asks you to pay a fee, open a link, or share a password. 15
  • A business treats this glossary page as legal advice. 21

What to do now

  1. If you want to understand your rights, start with GOV.UK and the ICO's pages for the public. 15
  2. If you are responsible for using personal data in a business, read the ICO's UK GDPR guidance and the data protection principles. 23
  3. If you are concerned about how an organisation is handling your personal data, you can contact the ICO. GOV.UK lists 0303 123 1113. Consider independent legal advice for a specific case. 15

UK reporting and support

  • Contact the ICO about a data-protection concern. GOV.UK lists 0303 123 1113. This is not a substitute for a solicitor. 15
  • If you also think a crime has taken place, use Report Fraud in England, Wales or Northern Ireland. In Scotland, call Police Scotland on 101. 689
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 7
  • If someone is in danger, call 999. 89

How to protect yourself

  • Be careful about how much personal data you share, and keep account sign-in details unique and hard to guess. 15
  • If you run a small organisation, follow the ICO principles and the ICO guidance on security, including encryption where it is appropriate. 32
  • Treat unexplained messages that claim to be from the ICO with caution. Go to ico.org.uk yourself. 5

Frequently asked questions

What rights do I have under UK GDPR if a shop will not delete my account?

People have rights, with some exceptions, including in some cases to have data erased. Whether that right applies depends on the situation. Start with the ICO's pages for the public, and contact the ICO if you need to take it further. This is not legal advice. 15

Is the ICO the same as the police?

No. The ICO is the UK regulator for data protection. If you think a crime has also taken place, report that separately to Report Fraud or, in Scotland, Police Scotland. 126

Do the UK GDPR and the Data Protection Act 2018 both apply?

Yes. GOV.UK says data protection in the UK is governed by both. Use GOV.UK and the ICO for the detail, and the text of the Act on legislation.gov.uk if you need the statute itself. 142

Matching kit

Data Protection Complaints Pack · £19 · Digital download.

A procedure, complaint form, letter templates and a log for the UK data protection complaints duty. It is practical help, not legal advice.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. GOV.UK, Data protection - GOV.UK. Accessed 10 November 2026 (Europe/London).
  2. ICO, UK GDPR guidance and resources | ICO. Accessed 10 November 2026 (Europe/London).
  3. ICO, Data protection principles | ICO. Accessed 10 November 2026 (Europe/London).
  4. legislation.gov.uk, Data Protection Act 2018. Accessed 10 November 2026 (Europe/London).
  5. ICO, For the public | ICO. Accessed 10 November 2026 (Europe/London).
  6. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  7. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  8. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  9. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).