The legal framework governing the use of personal and confidential data in health and social care is complex. It includes the NHS Act 2006, the Health and Social Care Act 2012, the Human Rights Act 1998, the Health & Social Care (Safety & Quality) Act 2015, and current Data Protection Legislation (the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) 2021). The updated Data Protection Act 2018 includes much of the GDPR.