Information-rights legislation in plain English

Use legislation as the framework, not as decoration.

ConsumerWise links legal provisions to the practical question they answer: what right exists, who owes the duty, what can be withheld, when a response is due and what happens next.

Four core frameworks.

The UK GDPR governs much of the general data-protection framework and individual rights. The Data Protection Act 2018 supplements and modifies that framework in UK law. The Freedom of Information Act 2000 creates rights to recorded information held by public authorities. The Environmental Information Regulations 2004 provide a parallel access regime for environmental information.

UK GDPR → personal data, processing principles and individual rights.
Data Protection Act 2018 → UK-specific provisions, exemptions and enforcement framework.
FOIA 2000 → recorded information held by public authorities.
EIR 2004 → environmental information and its own exceptions/review framework.

Read the operative rule alongside current ICO guidance.

Legislation can be amended and regulator guidance can be updated. ConsumerWise therefore treats current official guidance and the legislation itself as separate source layers.

Use legislation for the rule and regulator guidance for application.

Good research sequence.

1. Identify the correct statute/regulations. 2. Read the relevant provision. 3. Check current ICO/Scottish Commissioner guidance. 4. Check commencement/amendment dates. 5. Apply the rule to the actual records and chronology.

This avoids relying on an old blog post after the underlying law or regulator guidance has changed.

FOI and EIR are access-to-information laws, not personal-data substitutes.

FOI starts from a general right to recorded information and then applies exemptions. EIR provides a specialist, disclosure-favouring regime for environmental information. Personal data requested by the person it is about is ordinarily handled through the data-protection framework instead.

The 2025 DUAA changed the current data-protection framework.

The Data (Use and Access) Act 2025 amended parts of UK data law in phases. ICO guidance confirms that all data-protection provisions were in force by 19 June 2026. ConsumerWise therefore treats pre-DUAA summaries with caution where the topic is automated decision-making, complaints, recognised legitimate interests or another amended area.

UK GDPR and the Data Protection Act 2018 should usually be read together.

The UK GDPR contains the familiar principles, lawful bases and individual rights. The DPA 2018 supplements and modifies that framework in UK law, provides exemptions and contains separate regimes for competent-authority law enforcement and intelligence services. Quoting one without checking the other can give an incomplete answer.

The main information-rights laws work as a system.

Law	Main role
UK GDPR	Core rules for processing personal data and individual rights.
Data Protection Act 2018	UK framework supplementing the UK GDPR; also contains separate law-enforcement and intelligence-services regimes and other provisions/exemptions.
Data (Use and Access) Act 2025	Amends the UK data-protection framework; all data-protection provisions were in force by 19 June 2026.
Freedom of Information Act 2000	Access to recorded information held by covered public authorities, subject to exemptions.
Environmental Information Regulations 2004	Access to environmental information, with its own exceptions and review rules.
Freedom of Information (Scotland) Act 2002	Separate Scottish FOI regime for Scottish public authorities.

Official sources

Check the current source material.

ConsumerWise provides general information rather than individual legal advice. Check current rules, dates and eligibility against the official source before acting.