It was amended on 1 January 2021 by regulations under the European Union (Withdrawal) Act 2018, to reflect the UK's status outside the EU.

[9][10] Under the 2018 Act, the enforcement regime for registration changed from criminal to civil monetary penalties.

[11] The Act introduces a new public interest test applicable to the research processing of personal health data.

[18] When the Data Protection Act 1998 was being made, the GDPR did not exist, thus there was no law for the DPA to work with.

[clarification needed] Eventually, with the creation of the GDPR, the DPA was updated to work in tandem.