UK GDPR: The United Kingdom General Data Protection Regulation - the primary legislation governing data protection in the UK post-Brexit, setting out the key principles, rights and obligations for processing personal data
Data Protection Act 2018: The UK's implementation of data protection legislation that works alongside and supplements the UK GDPR, providing specific data protection requirements for UK organizations
PECR 2003: Privacy and Electronic Communications Regulations - specific rules for electronic communications, including rules about marketing, cookies and privacy
ICO DPIA Guidance: Official guidance from the Information Commissioner's Office on how to conduct Data Protection Impact Assessments, including templates and best practices
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practice and interpretation
Data Protection by Design Guidance: ICO's guidance on implementing privacy by design and default principles in data processing activities
Employment Law: Relevant employment legislation that intersects with data protection when DPIAs involve processing of employee personal data
Sector-Specific Regulations: Additional regulatory requirements specific to certain sectors such as healthcare (NHS guidelines) or financial services (FCA requirements)
Human Rights Act 1998: Legislation incorporating the European Convention on Human Rights into UK law, particularly Article 8 regarding right to privacy
Common Law Duty of Confidentiality: The common law obligation to keep certain information confidential, particularly relevant in professional relationships
NIS Regulations 2018: Network and Information Systems Regulations governing security of network and information systems for essential services and digital service providers
Freedom of Information Act 2000: Legislation governing public access to information held by public authorities, which intersects with data protection considerations
ISO/IEC 27701:2019: International standard for Privacy Information Management, providing guidance for processing personal data
ISO/IEC 29134:2017: International standard providing guidelines for Privacy Impact Assessment methodology and processes
