Credit Score Basics > What is the data protection act?

What is the data protection act?

Wollit Team2 minute read · Updated 17th September 2024

The Data Protection Act 2018 (DPA 2018 for short) is a law in the UK that tells companies how to collect, use, and store your personal information. Its main goal is to protect people's privacy.

The law gives you rights over your personal data, such as the right to know what information is held about you and the right to have that information deleted in some situations.

The DPA 2018 started on May 25, 2018, and replaced the older Data Protection Act 1998. It works together with the UK General Data Protection Regulation (UK GDPR), which is the UK’s version of the European Union's data protection rules.

How is the DPA 2018 different from the GDPR?

While the DPA 2018 and the UK GDPR are very similar, there are some differences:

The rights of individuals remain the same.
There are still six main rules for processing data and six legal reasons for doing so.
Organizations must keep personal data safe.
The DPA 2018 has specific rules for handling sensitive data and some unique UK exemptions.

How does the DPA 2018 protect my personal data?

The DPA 2018 has very specific rules that companies must follow when dealing with your personal data:

Data should only be collected for specific, lawful reasons.
Only the necessary data should be collected.
Data must be accurate and updated when needed.
Data should not be kept longer than necessary.
Data must be processed in a way that respects people's rights.

What rights do I have under the DPA 2018?

The DPA 2018 gives you several important rights regarding your personal data:

Right to know: You have the right to know what personal data is held about you.
Right to correction: You can ask for incorrect data to be fixed or deleted in some cases.
Right to prevent processing: You can stop your data from being used in ways that could cause harm or distress.
Right to object to marketing: You can refuse to have your data used for direct marketing.
Right to understand automated decisions: You have the right to know about automated decisions that significantly affect you.
Right to compensation: If you suffer due to a breach of the law, you can seek compensation.

How does the DPA 2018 relate to my credit score and finances?

The DPA 2018 is important for credit scores and your ability to get loans in the UK in a few ways:

Credit agencies must follow the DPA 2018 when they collect and use personal data to calculate your credit score.
Banks and other lenders must handle personal data according to the DPA 2018 rules when assessing loan applications.
You can request to see what data credit agencies and lenders have about you and ask for corrections if what they have is incorrect.
Lenders must keep your personal data safe and only use it for the reasons they collected it.
You can stop your data from being used for marketing loan offers you do not want.

Who can help me if I have a data protection issue?

If you think your data protection rights have been breached, then contact the Information Commissioner's Office (ICO). The ICO enforces DPA 2018, and has several powers to ensure compliance:

The ICO can require companies and banks to provide information about their data practices.
If there are breaches, the ICO can issue orders to stop illegal practices.
The ICO can also issue fines of up to £17.5 million or 4% of a company's global revenue.

On top of this, you can also seek compensation separately through the courts – you have multiple ways to get your rights protected.