I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR

I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021. [1] https://en.wikipedia.org/wiki/Data_Protection_Act_2018 https://en.wikipedia.org/wiki/Data_Protection_Act_2018