Data Protection Act 2018

The Data Protection Act 2018 (DPA 2018) is the UK's implementing statute that sits alongside the UK GDPR. It tailors the GDPR to the UK, governs processing not covered by the GDPR (notably immigration and intelligence-services processing, neither of which apply to us) and gives the ICO its powers of enforcement.

How we comply

• Part 2 (general processing). All controller and processor obligations under Part 2 are operated through the same controls described under our UK GDPR statement.
• Part 3 (law enforcement) and Part 4 (intelligence services). Out of scope. We are not a competent authority and do not process personal data for law-enforcement or intelligence-services purposes.
• Special category & criminal-offence data. The platform is not designed to capture special category or criminal-offence data. Clubs are contractually instructed not to upload such data unless we have agreed an Appropriate Policy Document in advance.
• Children's data. Many club members are under 18. The platform applies age-appropriate defaults consistent with the ICO's Children's Code, including data minimisation on member profiles and restricted communications.
• Sections 170–173 offences. Staff training explicitly covers the criminal offences of unlawfully obtaining, re-identifying and altering personal data. Logging and access reviews provide deterrent and detective controls.
• Subject access requests. Where we act as controller, requests are processed within the one-month statutory window with the limited extensions permitted by section 45.

The ICO is our supervisory authority for both the UK GDPR and the DPA 2018.