UK GDPR - Compliance Guide

· About UK GDPR

Key Takeaways

  • The UK GDPR applies to organisations that process personal data in the UK, and it also reaches some controllers and processors outside the UK when they offer goods or services to people in the UK or monitor their behaviour there.
  • The Information Commissioner’s Office (ICO) enforces the UK GDPR and can investigate, issue assessment notices, require corrective action, and impose administrative fines.
  • The Data (Use and Access) Act 2025 (DUAA) amended the UK GDPR in 2025–2026; the main data-protection changes were brought into force on 5 February 2026, with some provisions commenced earlier on 20 August 2025 and others later, so compliance programmes should reflect the revised text now in force.
  • The UK GDPR retains the core GDPR principles: lawful basis, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
  • For serious infringements, the maximum administrative fine remains £17.5 million or 4% of global annual turnover, whichever is higher, and the ICO can also issue enforcement notices and stop processing.
  • Organisations that already run ISO 27001, NIST CSF 2.0, or ISO/IEC 42001 can map those controls to UK GDPR accountability, security, and AI governance obligations, but those standards do not replace legal compliance.

What It Is

The UK GDPR is the United Kingdom’s retained data protection regime for personal data, built from the EU GDPR framework but amended for UK law after Brexit. It governs the processing of personal data by controllers and processors and sits alongside the Data Protection Act 2018. The ICO is the primary regulator and enforcement authority, while the current statutory text is on legislation.gov.uk and has been updated to reflect DUAA amendments in force by 2026.[1][2][3]

The modern UK GDPR framework was originally retained at the end of the Brexit transition on 31 December 2020. The next major change came with the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and made targeted amendments to the UK GDPR and DPA 2018.[1][3][5] The government’s commencement orders brought parts of the Act into force on 20 August 2025, and the main data protection and privacy provisions into force on 5 February 2026.[10][11]

Who Must Comply

The UK GDPR applies to controllers and processors processing personal data in the context of a UK establishment, even if the processing itself occurs outside the UK.[2][3] It also has extraterritorial reach where an organisation outside the UK offers goods or services to individuals in the UK or monitors their behaviour in the UK.[2]

There is no general size-based exemption for commercial entities, but some public-interest, law-enforcement, and employment-related processing has tailored rules through the DPA 2018 and sector-specific legislation.[2][3] The regime also uses the usual GDPR-style distinctions between personal data, special category data, and criminal offence data, which trigger different conditions and safeguards.[2]

The DUAA did not repeal the UK GDPR; it amended it. Organisations that relied on pre-2025 guidance should verify whether their notices, legitimate-interests assessments, complaint handling, and DSAR procedures reflect the revised wording now in force.[3][5][9]

Core Requirements

  1. Lawful, fair, and transparent processing — Every processing activity needs a lawful basis, must be fair, and must be explained in a clear privacy notice that tells individuals what data is collected, why, who receives it, and how long it is kept.[2][3]
  1. Purpose limitation and minimisation — Personal data must be collected for specified, explicit, and legitimate purposes and limited to what is necessary for those purposes; re-use for incompatible purposes requires a fresh legal basis or a valid compatibility analysis.[2]
  1. Accuracy and retention control — Controllers must take reasonable steps to keep personal data accurate and up to date and must not keep it longer than necessary for the stated purpose, legal obligation, or defended claim.[2]
  1. Security and accountability — Controllers and processors must implement appropriate technical and organisational measures, document compliance decisions, maintain contracts with processors, and be able to demonstrate compliance on request.[2][3]
  1. Data subject rights handling — Individuals retain rights of access, rectification, erasure, restriction, objection, and portability, and organisations must have processes to verify identity, manage deadlines, and issue lawful refusals where an exemption applies.[2][3][9]
  1. International transfer controls — Transfers of personal data outside the UK need a valid transfer mechanism, such as adequacy regulations, the UK International Data Transfer Agreement, or other permitted safeguards, together with a transfer risk assessment where required.[2][3]
  1. Breach response — Personal data breaches that are likely to result in a risk to individuals’ rights and freedoms must be reported to the ICO within 72 hours where feasible, and high-risk breaches must also be communicated to affected individuals without undue delay.[2]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | DUAA receives Royal Assent | 19 June 2025 | The UK GDPR is amended by the Data (Use and Access) Act 2025.[1][5] | | First commencement tranche | 20 August 2025 | Certain DUAA provisions, including amendments to UK GDPR/DPA 2018, enter into force.[10][13] | | Main data-protection commencement | 5 February 2026 | The majority of DUAA data protection and privacy provisions take effect.[11] | | Updated ICO guidance reflecting DUAA | 23 March 2026 | ICO guidance on legitimate interests is updated to reflect DUAA amendments.[9] |

The maximum administrative fine under the UK GDPR remains £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements.[2] Lesser infringements can still attract fines of £8.7 million or 2% of worldwide annual turnover, whichever is higher, along with reprimands, orders to comply, processing restrictions, and enforcement notices.[2]

Other sanctions include ICO audits and assessment notices, compulsory corrective measures, restrictions on data processing, and in some cases criminal liability under the DPA 2018 for separate offences such as unlawful obtaining or disclosure of personal data.[2][3]

How to Comply

  1. Map processing and lawful bases — Build a current record of processing activities, identify controllers, processors, joint controllers, data categories, retention periods, transfer routes, and lawful bases for each processing purpose.[2]
  1. Refresh notices and rights workflows — Rewrite privacy notices for clarity and ensure DSAR, objection, rectification, erasure, and complaint-handling workflows reflect the revised UK GDPR language and ICO guidance.[3][9]
  1. Align security controls to ISO 27001 — Use ISO 27001 to structure information security governance, risk treatment, access control, incident management, supplier assurance, and continual improvement, then test whether controls are proportionate to the risk posed by the data.[2]
  1. Use NIST CSF 2.0 for operational resilience — Map identify, protect, detect, respond, and recover functions to breach preparedness, logging, vulnerability management, and incident response, especially where processing supports critical services.[2]
  1. Add AI governance where automated decision-making matters — Where AI systems influence profiling, decision support, or automated decisions, use ISO/IEC 42001 to formalise governance, impact assessment, human oversight, and control of training data and outputs.[2][3]
  1. Re-check international transfers — Inventory all non-UK transfers, confirm adequacy or safeguards, and document transfer risk assessments and supplementary measures where needed.[2]
  1. Test vendor and processor contracts — Ensure data processing agreements contain the UK GDPR-mandated clauses on instructions, confidentiality, subprocessing, security, assistance, deletion or return, and audit rights.[2]

Related Regulations

The EU GDPR is the closest analogue and often overlaps for multinational organisations, but UK and EU transfer rules now run on separate legal bases and must be assessed separately.[2]

The Data Protection Act 2018 supplements the UK GDPR with UK-specific rules, exemptions, and enforcement mechanics, including criminal offences and conditions for special category or criminal offence data.[1][3]

The Privacy and Electronic Communications Regulations 2003 (PECR) can apply alongside the UK GDPR to cookies, direct marketing, and electronic communications, so consent and opt-out rules may need to be satisfied in parallel.[5]

The Data (Use and Access) Act 2025 is not a separate regime but a reform statute that amended the UK GDPR and related privacy laws, so it can change controller obligations without replacing the underlying framework.[3][5]

The EU AI Act may overlap where AI systems are deployed into the EU market, creating additional governance, transparency, and documentation requirements beyond UK GDPR obligations.[2]

FAQ

Does the UK GDPR apply to companies outside the UK?

Yes, if they offer goods or services to people in the UK or monitor their behaviour in the UK. The rule is function-based, not entity-based, so an overseas business can be fully in scope without a UK office.[2]

Did the Data (Use and Access) Act 2025 replace the UK GDPR?

No. It amended the UK GDPR and the DPA 2018 rather than replacing them. The government states the Act simplifies some rules while preserving UK data protection standards.[3][5]

What changed in 2026?

The main data-protection and privacy provisions of the DUAA commenced on 5 February 2026, and the ICO updated some guidance, including legitimate-interests guidance, to reflect the new law.[9][11] Organisations should check for changes to legitimate interests, complaints handling, and subject access request practice.[3][9]

What is the maximum UK GDPR fine?

The highest maximum is £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious infringements.[2] Lower-tier infringements can still attract substantial fines and mandatory corrective orders.[2]

Does ISO 27001 make an organisation UK GDPR compliant?

No. ISO 27001 helps establish an information security management system, but UK GDPR also requires lawful basis, transparency, rights handling, transfer controls, processor contracts, and accountability evidence.[2] ISO 27001 is best used as a control framework that supports compliance.

How does the UK GDPR differ from the EU GDPR now?

The frameworks remain very similar, but they are no longer identical because the UK has its own amendments, guidance, and transfer regime. Multinational organisations should treat UK and EU compliance as related but separate assessments.[2][3]

Sources

Put it into practice

More compliance guides