By Daniel de Almeida Afonso · Last updated: October 12, 2026
UK GDPR is the United Kingdom's own version of the EU General Data Protection Regulation. It has applied since January 1, 2021, it works alongside the Data Protection Act 2018 (DPA 2018), and it carries fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The EU GDPR no longer applies in the UK as law, but it can still apply to you if you offer goods or services to people in the EU.
As of October 12, 2026, the data protection changes in the Data (Use and Access) Act 2025 are all in force, the EU has renewed its UK adequacy decision to December 27, 2031, and the ICO now operates as the Information Commission.
This guide is general information, not legal advice. For the Act in more depth, see our Data (Use and Access) Act 2025 explainer.
What is UK GDPR, and how does it fit with the DPA 2018?
The UK left the EU on January 31, 2020, and the Brexit transition period ended on December 31, 2020. From the next day, the EU GDPR stopped applying in the UK as law. In its place, the UK kept the same text as domestic law, with terms such as "the Union" and "supervisory authority" swapped for UK equivalents. That retained text is the UK GDPR.
Three pieces of law now make up the UK regime:
- UK GDPR: the principles, individual rights, and controller and processor duties.
- The Data Protection Act 2018: the UK Act that supplements the UK GDPR with exemptions, the ICO's powers, and rules for areas the GDPR leaves to national law. Read more in our guide to the Data Protection Act 2018.
- The Data (Use and Access) Act 2025 (DUAA): an amending Act (2025 c. 18) that changes both of the above and the Privacy and Electronic Communications Regulations 2003 (PECR). It received Royal Assent on June 19, 2025.
In 2019 and 2020, commentary asked whether a no-deal Brexit would remove GDPR duties from UK businesses. That question is settled: the UK has its own regime, and the EU has recognized it as adequate.
Who has to comply with UK GDPR?
You must comply if you are a controller (you decide why and how personal data is used) or a processor (you handle it on a controller's behalf) and either of these is true:
- You operate in the UK.
- You are based outside the UK and offer goods or services to people in the UK, or monitor their behavior.
When a non-UK business needs a UK representative
A business outside the UK with no UK branch, office, or other establishment must appoint a representative in the UK if it offers goods or services to people in the UK or monitors their behavior. The appointment must be in writing, and the representative's details should be easy to find, for example in the privacy notice.
Two exemptions apply under Article 27 of the UK GDPR:
- Public authorities and bodies.
- Processing that is occasional, unlikely to put individuals' rights at risk, and does not involve large-scale special category or criminal offense data.
A representative is a point of contact. It does not reduce your own liability.
Does the EU GDPR still apply to UK organizations?
Sometimes, yes. The EU GDPR applies to any organization, wherever it is based, that offers goods or services to people in the EU or monitors their behavior. The ICO says the same for UK organizations and notes that it cannot give specific guidance on the EU GDPR.
A UK business with customers in both places therefore usually follows both laws. Because the two texts remain close, the extra work is limited:
- EU representative: a UK organization with no base in the EEA may need to appoint one under Article 27 of the EU GDPR. It must sit in an EEA country where some of the affected people are. Our guide explains who needs a representative in the EU.
- Lead supervisory authority: since January 1, 2021, the ICO can no longer act as the lead authority under the EU's one-stop-shop. A UK business with an EU establishment should check which EU authority leads for it. A business with no EU establishment has no lead authority and can face several national regulators.
UK GDPR vs EU GDPR: what actually differs?
The core principles, lawful bases, and individual rights are the same. The differences sit at the edges, and the 2025 Act has widened a few of them.
| Topic | UK GDPR | EU GDPR |
|---|---|---|
| Regulator | The ICO, now the Information Commission | National supervisory authorities, coordinated by the EDPB |
| Age of consent for online services | 13 | 16 by default; member states may set it lower, but not below 13 |
| Maximum fine (higher tier) | £17.5 million or 4% of worldwide turnover | €20 million or 4% of worldwide turnover |
| Automated decisions | Restricted mainly where the decision is significant and uses special category data; safeguards required for other significant decisions | General restriction on solely automated decisions with legal or similarly significant effects |
| Lawful bases | Adds "recognised legitimate interests" for listed purposes such as crime prevention and safeguarding | No equivalent |
| Representative | UK representative for non-UK organizations | EU representative for non-EU organizations |
| Transfer tools | UK adequacy regulations, IDTA, UK Addendum, UK BCRs | EU adequacy decisions, EU SCCs, EU BCRs |
If you operate in both regimes, apply the stricter rule where the two differ.
What did the Data (Use and Access) Act 2025 change?
The Act did not replace the UK GDPR. It amended it, and it came into force in stages. The ICO's guidance said the changes would be phased in between June 2025 and June 2026, and on June 19, 2026 it confirmed that all data protection provisions are in force.
| Date | What happened | Source |
|---|---|---|
| June 19, 2025 | Royal Assent | The Act (2025 c. 18) |
| February 5, 2026 | Most data protection and PECR changes took effect: lawful bases, automated decisions, research, transfers, cookies, PECR fines, ICO powers | SI 2026/82 |
| June 19, 2026 | The new right to complain to controllers took effect | SI 2026/82, regulation 3 |
| September 30, 2026 | The Information Commission replaced the Information Commissioner | SI 2026/1015 |
The changes that matter most for day-to-day compliance:
- Complaints: you must make it easy for people to complain, for example with an electronic complaints form. You must acknowledge a complaint within 30 days and respond without undue delay. The duties apply to complaints received from June 19, 2026.
- Subject access requests: you need to run only reasonable and proportionate searches.
- Recognised legitimate interests: for listed purposes such as protecting public security, you do not need to balance your interests against the individual's. Most organizations will still rely on an ordinary legitimate interests assessment.
- Automated decision-making: you can rely on a wider set of lawful bases for significant automated decisions if you apply safeguards. The tighter rule stays for special category data.
- International transfers: the test for sending data abroad was reworded. It now asks whether protection is "not materially lower" than in the UK. More on this below.
Cookies and PECR: what changed on February 5, 2026
PECR, not the UK GDPR, governs cookies and similar technologies. The Act changed it in two ways that matter.
First, some low-risk uses no longer need consent. The ICO describes five exceptions: communication, strictly necessary, statistical purposes, appearance, and emergency assistance. Statistical (analytics) and appearance uses come with conditions: clear information, a simple and free way to object, and no tracking or profiling of individuals. Any advertising use still needs consent, and browser settings alone do not count as an objection.
Second, PECR fines now follow the UK GDPR scale. For breaches on or after February 5, 2026, the maximum is the higher UK GDPR amount, which is £17.5 million or 4% of worldwide turnover. Law-firm summaries put the old cap at £500,000. Conduct before February 5, 2026 is still dealt with under the old rules.
Before you remove any analytics consent prompt, check that your setup meets the statistical exception. Our guide to UK GDPR cookie consent requirements covers the setup.
ICO powers, fines, and complaints
The maximum UK GDPR fines are set in section 157 of the DPA 2018:
- Higher maximum: £17.5 million or 4% of worldwide turnover, whichever is higher. It covers breaches of the core principles and individual rights.
- Standard maximum: £8.7 million or 2% of worldwide turnover, whichever is higher. It covers other provisions, such as processor and record-keeping duties.
These are ceilings, and recent penalties have been lower. In October 2025 the ICO fined Capita £14 million in total (£8 million for Capita plc and £6 million for Capita Pension Solutions Limited) after a 2023 cyber attack exposed the data of 6.6 million people,. In February 2026 it fined Reddit £14.47 million for processing children's data without robust age assurance and without a timely data protection impact assessment. Reddit has appealed to the First-tier Tribunal. See our guide to GDPR fines and penalties for how regulators set amounts.
The Act also changed how the ICO works:
- New powers: the ICO can compel a witness to attend an interview and can require reports from approved persons.
- A time limit after a notice of intent: the regulator must decide within six months, or as soon as reasonably practicable after, whether to issue a penalty notice or confirm that none will follow.
- A new structure: since September 30, 2026 the regulator is a board-led body, the Information Commission, instead of a single Commissioner. The ICO name stays, and the transition adds no new duties for controllers or processors.
Is the UK still adequate under EU law?
Yes. On December 19, 2025 the European Commission adopted renewed adequacy decisions for the UK, one under the EU GDPR and one under the Law Enforcement Directive. Both last until December 27, 2031, according to the ICO.
The 2021 decisions would have expired on June 27, 2025. According to law-firm summaries, the Commission first extended them for six months, then renewed them after an opinion from the EDPB and approval from member states, with the DUAA considered in its assessment. One law firm reports that the Commission committed to a review after four years.
In practice, organizations in the EEA can still send personal data to the UK without standard contractual clauses or other safeguards. Adequacy depends on the UK staying aligned in practice as well as on paper.
How do you send personal data out of the UK?
For a restricted transfer, meaning data leaving the UK to a country without its own protection under UK law, you need one of three routes. Our guide to data transfers under the GDPR covers the EU side.
- UK adequacy regulations. If the UK government has recognized the destination, no extra safeguard is needed, and you do not have to carry out a transfer risk assessment.
- Appropriate safeguards. Typically either the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. The Addendum can suit you if you already use the EU SCCs, and the IDTA is a standalone alternative. You must also complete a transfer risk assessment (TRA) to confirm that protection is not materially lower after the transfer.
- A listed exception. The UK GDPR allows a few narrow exceptions in Article 49, intended for limited, case-by-case use rather than routine transfers.
The ICO updated its transfer guidance on January 15, 2026 to reflect the Act. The legislation now calls the TRA a "data protection test". The ICO still uses "TRA", and it says it plans to update the IDTA and Addendum during 2026. Until then, keep using the current versions.
The UK-US data bridge
The UK-US data bridge, formally the UK Extension to the EU-US Data Privacy Framework, lets you send personal data to a certified US recipient without an IDTA, an Addendum, or a TRA. Law-firm summaries date it from October 12, 2023. Use it only if the recipient:
- has an active Data Privacy Framework (DPF) listing,
- has opted in to the UK Extension, and
- has a certification that covers the type of data you send (HR data, non-HR data, or both).
Check the list periodically, because status can lapse. Special category and criminal offense data need extra steps, because the DPF's definition of sensitive data is narrower than the UK's.
The ICO updated its guidance on July 30, 2026 to say the UK's US adequacy regulations are independent of the EU's finding. If the EU framework were struck down, the UK bridge would not fall automatically, although the UK government would have to review it. The challenge to the EU framework, brought by Philippe Latombe, is on appeal to the EU Court of Justice (Case C-703/25 P), according to law-firm summaries. Keep an IDTA or Addendum ready as a fallback for key US vendors.
What should you do now?
Use this checklist if you handle UK personal data:
- Update your records. Revise your privacy notice and records of processing for the UK GDPR as amended by the Act.
- Build a complaints process. Add a complaints form, a 30-day acknowledgment step, and a log, and train the staff who receive them.
- Re-test your cookies. Sort each cookie and tracker into consent-required or exempt, and confirm any exemption conditions are met.
- Map your data flows. List where UK personal data goes, which transfer route covers each flow, and which TRA or DPF check backs it up.
- Check representatives. Confirm you have a UK representative if you are outside the UK, and an EU representative if you are outside the EEA and serve people there.
- Review automated decisions. Identify significant decisions made without human involvement and confirm the safeguards you apply.
Secure Privacy is a consent management platform. Its cookie scanner, consent banner, and consent logs support steps 3 and 4 of this list.
Frequently asked questions
Is UK GDPR the same as EU GDPR?
No, UK GDPR is a separate legal text copied from the EU GDPR, so the principles and rights are nearly identical. The differences include the regulator, the age of consent (13 in the UK), and, since the 2025 Act, rules on automated decisions and recognised legitimate interests.
What is the maximum fine under UK GDPR?
The higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher, and the standard maximum is £8.7 million or 2%. These caps also apply to PECR breaches on or after February 5, 2026.
Has the EU renewed the UK's adequacy decision?
Yes, the European Commission renewed it on December 19, 2025, and it now runs to December 27, 2031. Personal data can flow from the EEA to the UK without extra safeguards, but the decision depends on the UK staying aligned.
Do I need a UK representative?
You need one if you are outside the UK, have no UK establishment, and offer goods or services to people in the UK or monitor their behavior. Public authorities and occasional, low-risk processing are exempt.
Do I need to follow both UK GDPR and EU GDPR?
If you serve people in both places, usually yes. Because the texts are close, one compliance program can cover both, with local additions such as a UK and an EU representative where relevant.
Do I still need cookie consent in the UK?
Yes, for most cookies. Strictly necessary cookies are exempt. Since February 5, 2026, analytics and appearance cookies are also exempt if you give clear information and a free, simple way to object. Advertising and cross-site tracking cookies still need consent.
Is the ICO still the UK data protection regulator?
Yes, but its legal form changed. On September 30, 2026 the Information Commissioner's Office became the Information Commission, a board-led body that kept the ICO name and took over the Commissioner's functions.
