The key point: the Data Protection Act 2018 and the UK GDPR work together , and breaches can lead to fines or legal action for both organisations and, in some cases, individuals.

Core facts you need

  • The UK GDPR sets the main data protection rules (lawful basis, rights, principles). It is the primary framework.
  • The Data Protection Act 2018 (DPA 2018) supplements and tailors the UK GDPR for the UK context (adds exemptions, special rules, law enforcement, intelligence services, etc.).
  • Together, UK GDPR + DPA 2018 form the UK’s current data protection regime.
  • Breaches of UK GDPR/DPA 2018 can lead to regulatory investigation, fines, and other legal action against organisations, and in some circumstances criminal liability for individuals.
  • They apply to personal data in both digital and non‑digital forms (paper files, manual records, if part of a filing system).
  • They do not prevent information from being shared for health and care purposes; they regulate how it is shared (lawful basis, necessity, safeguards, special category rules).

Likely exam‑style options (and which are correct)

A very common training/exam question lists statements like these (or very similar):

  1. “They prevent information being shared for health and care purposes.”
  2. “The Trust can be fined or face legal action for breaching the principles.”
  3. “They only apply to personal information in digital form.”
  4. “You can be fined or face legal action for breaching the principles.”

From the legal position above:

  • Statement 1 – Incorrect : data protection laws allow sharing for care, public health, etc., provided the conditions and safeguards are met.
  • Statement 2 – Correct : an organisation such as an NHS Trust can be fined or face other enforcement for breaches.
  • Statement 3 – Incorrect : they cover personal data in electronic and certain structured paper formats.
  • Statement 4 – Correct in many training/exam contexts, because individuals can also face legal consequences (e.g. offences under DPA 2018) in some circumstances.

An online worked solution to a near‑identical question confirms that the two correct answers (when those four are the options) are that:

  • the organisation (e.g., the Trust) can be fined or face legal action; and
  • you (an individual) can be fined or face legal action for breaching the principles.

Quick comparison table

[5][3][2] [1][2] [4][2] [2][4]
Exam-style statement Correct? Why
They prevent information being shared for health and care purposes No Laws permit sharing for care/public health with lawful basis and safeguards, especially for special category data like health.
The Trust can be fined or face legal action for breaching the principles Yes Regulators can impose fines and enforcement measures on organisations for breaches of UK GDPR/DPA 2018.
They only apply to personal information in digital form No They apply to personal data in electronic and certain structured paper/manual formats.
You can be fined or face legal action for breaching the principles Yes (in typical training questions) DPA 2018 contains criminal offences; individuals can in some situations face prosecution or sanctions.

How to answer similar questions

When you see “which statements on the Data Protection Act 2018 and UK GDPR are correct?”:

  • Look for statements saying they work together and that the DPA 2018 supplements UK GDPR – those are usually correct.
  • Treat any claim that they stop sharing data for care, or only cover digital information, as suspicious and usually wrong.
  • Statements about fines or legal action for breaches are generally correct (for organisations, and in some cases individuals).

Information gathered from public forums or data available on the internet and portrayed here.