This Practice Note explains the offences relating to the misuse or mishandling of personal data under the Data Protection Act 2018 (DPA 2018). It covers the data protection offence of unlawfully obtaining of data, re-identification of de-identified data, the alteration of personal data to prevent disclosure, the prohibition of requirement to produce relevant records as well as the offences which can be committed during an investigation by the Information Commissioners Office (ICO) of obstruction, making a false statement in response to information notices and destroying or falsifying information. The Practice Note also explains the scope of these data protection offences, the available defences as well as the maximum sentences which can be imposed on conviction.