Security & governance
UK GDPR
The UK GDPR is the United Kingdom's general data protection regulation: the version of the EU GDPR that was kept in UK law when the Brexit transition period ended. It sits alongside the Data Protection Act 2018, is enforced by the Information Commissioner's Office, and applies to organizations that process the personal data of people in the UK.
How does the UK GDPR differ from the EU GDPR?
The two texts started out almost identical and share the same principles, roles and rights, so the description under GDPR largely holds. The differences lie in who enforces the law, how international transfers are approved, and the reforms each side has made since.
| Topic | EU GDPR | UK GDPR |
|---|---|---|
| Regulator | National authorities in each member state | Information Commissioner's Office |
| Companion law | Member state laws | Data Protection Act 2018 |
| Transfers abroad | Adequacy decisions by the European Commission | UK adequacy regulations and a data protection test |
| Maximum fine | 20 million euros or 4 percent of turnover | 17.5 million pounds or 4 percent of turnover |
| Recent reform | Unchanged core text | Data (Use and Access) Act 2025 |
What did the Data (Use and Access) Act 2025 change?
The Act received Royal Assent on 19 June 2025, and its main data protection changes entered into force on 5 February 2026. It adds a list of recognised legitimate interests as a basis for processing, widens the room for solely automated decisions, introduces a new test for international transfers, requires controllers to run a complaints procedure, and reshapes the regulator into a body to be called the Information Commission. Proposals to drop data protection officers, records of processing and impact assessments were not carried through.
Can personal data still move between the UK and the EU?
Yes. The European Commission first found UK law adequate in June 2021. Those decisions were extended during the reform and then renewed on 19 December 2025, and they now run until 27 December 2031. Transfers from the EU to the UK therefore need no additional safeguards. In the other direction, the UK treats the EU as adequate. Transfers to other countries are assessed under UK rules, which is where questions about extraterritorial data access arise.
What does the UK GDPR mean for storage and backup?
The storage consequences match those of the EU regulation: retention limits that are enforced, security appropriate to the risk, the ability to restore personal data after an incident, and evidence of all three. Organizations operating in both jurisdictions usually apply one set of controls and keep UK and EU data on infrastructure whose location they can state, a form of data localization. A data processing agreement is required with any provider that stores personal data on the organization's behalf.
Frequently asked questions
Is the UK GDPR the same as the EU GDPR?
They share the same structure and principles, but they are separate laws with separate regulators, and the UK has amended its version.
Who enforces the UK GDPR?
The Information Commissioner's Office. The Data (Use and Access) Act 2025 provides for it to become the Information Commission.
Does the EU still treat the UK as adequate?
Yes. The adequacy decisions were renewed in December 2025 and run until 27 December 2031.
Related terms
- GDPR: the EU regulation the UK version derives from.
- Schrems II: the ruling that reshaped international transfers.
- Data localization: keeping data within a jurisdiction.
- Data processing agreement (DPA): the contract required with processors.
- Data controller vs. data processor: the two roles both laws define.