UK GDPR

What is the UK GDPR?

The UK GDPR is the United Kingdom's version of the EU GDPR. When the UK left the EU, it kept the regulation as part of its own law. The Data Protection Act 2018 defines the UK GDPR as the EU regulation as it forms part of UK law under the European Union (Withdrawal) Act 2018.

The two UK laws work as a pair. The UK GDPR holds the main rules, and the Data Protection Act 2018 adds detail, such as the maximum fines. Much of the text still matches the EU version, including the duty to report a qualifying personal data breach to the regulator within 72 hours. The differences are in who enforces it, how data leaves the country and a set of UK-only changes that took effect in 2025 and 2026.

Who it applies to

Under Article 3, the UK GDPR covers processing in the context of a UK establishment, wherever the processing happens. It also covers a company with no UK establishment when it offers goods or services to people in the UK or monitors their behavior there. So a US company can fall under it without a UK office.

A company covered that way must also name a UK representative in writing under Article 27, as a contact for individuals and the regulator. The exception is processing that is occasional, unlikely to put people at risk and does not involve large-scale special category or criminal offense data.

The regulator and fines

On 30 September 2026, the Information Commission took over the functions of the Information Commissioner's Office (ICO) as the UK's data protection regulator, a change made under the Data (Use and Access) Act 2025. It is a body corporate led by executive and non-executive members with collective responsibility, instead of a single commissioner, and the government says its role, responsibilities and powers are unchanged. The regulator says it will continue to be known as the ICO, and its guidance is still published at ico.org.uk. The UK GDPR text on legislation.gov.uk now says "the Commission" where it used to say "the Commissioner".

Under section 157 of the Data Protection Act 2018, the highest fines reach £17,500,000 or 4% of total annual worldwide turnover, whichever is higher. If you have users in both the UK and the EU, you answer to both laws and both sets of regulators.

What the Data (Use and Access) Act 2025 changed

The Data (Use and Access) Act 2025, which became law on 19 June 2025, amends the UK GDPR, the Data Protection Act 2018 and PECR, the UK's rules on cookies and electronic marketing. Most of its data protection changes took effect on 5 February 2026, the new complaints duty followed on 19 June 2026, and the ICO's guidance says all of the Act's data protection provisions are now in force. According to the ICO's summary, the main changes for companies are:

• Recognised legitimate interests: for certain purposes, such as public security, you no longer have to weigh the impact on people against the benefit of the processing.
• Automated decisions: significant automated decisions can rely on any lawful basis if you apply safeguards. This does not extend to special category data.
• Subject access requests: you need to make only "reasonable and proportionate searches" when answering a DSAR.
• Complaints: you must make it easier to complain, for example with an electronic form, and acknowledge complaints within 30 days.
• Cookies: some cookies, such as those used for statistics or site functionality, can now be set without consent.
• Transfers: the test for sending data abroad was reworded. The ICO lists this among changes that make the law clearer without materially changing how you can use personal data.

Sending data out of the UK

The UK has its own transfer tools. The ICO's guidance covers the UK's own adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum to the EU standard contractual clauses and UK binding corporate rules. UK law now calls the transfer risk assessment a "data protection test".

For US recipients, the UK Extension to the EU-US Data Privacy Framework has applied since 12 October 2023. It covers only US companies shown on the Data Privacy Framework List as participating in the UK Extension.

Data coming the other way is simpler. The European Commission renewed its adequacy decisions for the UK on 19 December 2025, and the ICO says both last until 27 December 2031.

What it looks like in a vendor's terms

Vendor DPAs usually handle the UK in its own definition and transfer section. A typical clause reads like this:

"UK Data Protection Laws" means the UK GDPR and the Data Protection Act 2018. Where Customer Personal Data is transferred from the United Kingdom to a country not covered by adequacy regulations, the UK Addendum to the Standard Contractual Clauses will apply. Where Processor is certified to the UK Extension to the EU-US Data Privacy Framework, Processor may rely on that certification instead.

• "UK Data Protection Laws": a definition separate from the EU one. If a DPA defines only EU law, UK data may not be covered.
• "Adequacy regulations": the UK's own list of approved destinations, not the EU's.
• "UK Addendum": the add-on that makes the EU clauses work for transfers out of the UK.
• "Certified to the UK Extension": a step beyond EU-US certification. Check that the vendor's listing includes it.

Why it matters to you

UK users bring a second law, a second regulator and a second set of fines. A DPA that covers only the EU GDPR can leave your UK users' data without a clear transfer tool when it goes to a US vendor.

The 2025 Act also changes your own duties. Since 19 June 2026 you need a complaints process that acknowledges complaints within 30 days, and your DSAR process can rest on reasonable and proportionate searches. Your UK customers may ask that your own DPA covers the UK GDPR, so your vendor contracts need to support the promises you make.

What to check

• Scope: Whether you offer services to people in the UK or monitor their behavior there, and if so whether you need a UK representative.
• Vendor DPAs: Each DPA names the UK GDPR and the Data Protection Act 2018, and gives a UK transfer tool such as the IDTA or the UK Addendum.
• US vendors: A vendor relying on the Data Privacy Framework for UK data is listed as participating in the UK Extension, not only the EU-US part.
• Complaints: Your privacy notice explains how to complain, and you can acknowledge a complaint within 30 days.
• Cookies: Which of your cookies fit the new UK exceptions, before you stop asking consent for them. The EU rules have not changed in the same way; see the ePrivacy Directive.
• Your own DPA: When a customer sends a DPA request, your answer on UK transfers matches what your vendors promise you.

How Venpo helps

Venpo watches your vendors' DPAs, privacy policies, cookie policies and subprocessor lists, and emails a plain-English alert when one changes. If a vendor rewrites its UK section, swaps a transfer tool or adds a subprocessor in a new country, the alert says what changed and why it matters.

Each vendor gets a change history with a redline of every change, so you can show what a DPA said when you signed it. The Fine Print Scan answers, per vendor, questions such as whether your data goes to China or other restricted countries and how many companies have it.