Data Protection Act 2018 (United Kingdom)
What the DPA covers, and what it means for your website analytics
Official name: Data Protection Act 2018 (DPA). In force since 25 May 2018, it works alongside the UK GDPR to set the rules for processing personal data in the United Kingdom.
See all privacy lawsAt a glance
The UK's data protection framework
The UK GDPR sets the main rules, carried over from EU law after Brexit. The Data Protection Act fills in the detail: UK exemptions, rules for law enforcement and the intelligence services, and the Information Commissioner's powers.
Both were updated by the Data (Use and Access) Act 2025, most of which has applied since February 2026.
Who it covers
Organizations in the UK, and those elsewhere that serve or monitor people there
What it means for websites
IP addresses and cookie IDs are personal data, so analytics needs a legal basis
Who enforces it
The Information Commissioner's Office (ICO)
Maximum fines
Up to £17.5 million or 4% of global annual turnover, whichever is higher
Further reading
Everything you need on this law
The Data Protection Act 2018
The current text of the UK’s Data Protection Act 2018, with all amendments.
Read the official textICO guidance on UK data protection
The UK regulator’s guidance on the UK GDPR and Data Protection Act, written for organizations.
Read the ICO guidanceThe UK GDPR
The UK’s version of the GDPR, which sets the core rules the Data Protection Act 2018 builds on.
Read the official textPECR
The UK’s cookie law, which sits alongside the Data Protection Act and decides when you need consent to access a visitor’s device.
Read our PECR guideMore privacy laws
Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.
See all privacy lawsTWIPLA and UK data protection
Built for the UK GDPR and the Data Protection Act
The UK GDPR keeps legitimate interest as a legal basis, and that's the basis TWIPLA uses in Maximum Privacy Mode: understanding how your website is used, without profiling anyone. You don't need visitor consent.
- IP addresses are never stored, only a one-way visitor hash
- Reports are aggregated, with no individual page histories
- Data is hosted in Germany, which the UK recognizes as offering adequate protection
- Our Data Processing Agreement lists every subprocessor
As the controller, you describe TWIPLA in your privacy policy and record it in your processing records with a short legitimate-interest assessment.
Proof, not promises
How TWIPLA meets UK data protection law
Our Data Processing Agreement
The Art. 28 agreement every TWIPLA customer signs, with all subprocessors listed.
Read the agreementWhy we host in Germany
Why all TWIPLA data stays in Germany, which the UK recognizes as safe for transfers.
Read the articleWhat to put in your privacy policy
Ready-to-use wording for describing TWIPLA in your privacy policy.
Get the wordingVirgin Atlantic
How a UK airline sets data collection country by country and keeps sensitive data restricted to the right teams.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
