In 2018, the Data Protection Act 2018 (DPA 2018) became the main data protection law of the UK. It was passed to line up the UK's national legislation with the EU GDPR. The DPA 2018 details the main requirements for protecting the personal data of UK individuals processed by businesses in the UK or globally.
When the UK left the EU, the UK GDPR was passed and came into effect in February 2021. Before 2018, the UK passed the Privacy and Electronic Communication Regulations (PECR) 2003 to transpose the EU's ePrivacy Directive into national law.
These regulations set the rules for the security of electronic communication, cookies, and direct marketing. In short, the DPA 2018, the UK GDPR, and the PECR form the foundations of UK data protection law.