Loading…
Region
Europe
Coverage
Full Coverage
Regulator
Information Commissioner's Office
Max Penalty
£17.5M or 4% of global turnover
The UK's Regulatory Landscape at a Glance
The UK's framework combines the UK GDPR and the Data Protection Act 2018 with rules on electronic marketing and cookies, cybersecurity requirements for certain operators, and sector-specific regulation. Depending on its activities, an organisation may need to consider several of these alongside one another.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and whether it is established in the UK.
- Jurisdiction
- United Kingdom
- Primary data protection framework
- UK GDPR and the Data Protection Act 2018
- Recent reform
- Data (Use and Access) Act 2025
Key Regulations in the United Kingdom
UK General Data Protection Regulation (UK GDPR)
The UK GDPR is the retained version of the EU GDPR, as amended for the UK. It sets the core principles, lawful bases, individual rights, and controller and processor obligations for processing personal data.
Depending on applicability, organisations may need to address:
- A lawful basis and transparency information for each processing activity.
- Individual rights, including access, rectification, erasure, and objection.
- Records of processing and accountability documentation.
- Data protection impact assessments for high-risk processing.
- Appropriate technical and organisational security measures.
- Personal data breach notification to the ICO and, where required, individuals.
- Controller-processor contracts and international transfer safeguards.
- A UK representative where Article 27 applies.
Organisations should assess the UK GDPR's territorial scope, available exemptions, and their specific role before determining which obligations apply.
Data Protection Act 2018
The Data Protection Act 2018 sits alongside the UK GDPR. It sets out exemptions, conditions for processing special category and criminal offence data, and separate regimes for law enforcement and intelligence services processing.
It also establishes the Information Commissioner's functions, enforcement powers, and criminal offences. The UK GDPR and the Act should be read together.
Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent in June 2025. It amends the UK GDPR, the Data Protection Act 2018, and PECR rather than replacing them.
Its changes include a list of recognised legitimate interests, adjustments to the rules on automated decision-making, a requirement to handle data protection complaints, and higher maximum fines under PECR. Provisions are being brought into force in stages.
Organisations should confirm which provisions have commenced before relying on any change introduced by the Act.
Privacy and Electronic Communications Regulations 2003 (PECR)
PECR governs electronic direct marketing, cookies and similar technologies, and the security of public electronic communications services.
Organisations should review their marketing consents, cookie banners, and tracking technologies against PECR as well as the UK GDPR, since both can apply to the same activity.
Network and Information Systems Regulations 2018
The NIS Regulations impose security and incident reporting duties on operators of essential services and relevant digital service providers.
Organisations within scope should coordinate cyber incident handling with personal data breach assessment where an incident may involve personal data. The UK government has proposed further cyber security legislation, so this area should be monitored.
Sector-Specific Regulatory Requirements
Businesses operating in regulated industries may face additional obligations beyond general data protection law.
Sector considerations:
- Financial services: FCA and PRA requirements, including operational resilience and outsourcing rules, may apply depending on the regulated activity.
- Online services: the Online Safety Act 2023, enforced by Ofcom, places duties on certain user-to-user and search services.
- Children's services: the ICO's Age Appropriate Design Code applies to online services likely to be accessed by children.
- Healthcare: organisations should assess confidentiality duties and health-sector data requirements alongside general data protection law.
Who Needs to Comply With UK Data Protection Laws?
UK data protection requirements may apply to:
UK-established organisations
Controllers and processors that process personal data in the context of a UK establishment.
International companies
Businesses outside the UK that offer goods or services to individuals in the UK or monitor their behaviour there, which may also need a UK representative.
SaaS and technology providers
Companies processing customer, employee, user, or account information, whether as a controller or as a processor for their customers.
E-commerce and digital platforms
Businesses using cookies, tracking technologies, and electronic marketing, which fall under PECR as well as the UK GDPR.
Employers
Organisations handling employee records, recruitment data, workplace monitoring, and other employment-related personal data.
Online services used by children
Services likely to be accessed by children, which should consider the ICO's Age Appropriate Design Code.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the UK GDPR
Controller and Processor Responsibilities
Controllers decide why and how personal data is processed; processors act on their instructions. Each role carries its own obligations, and contracts between them must contain specified terms. Organisations should confirm their role for each processing activity.
Lawful Basis and Transparency
Each processing activity needs a lawful basis, with further conditions for special category and criminal offence data. Privacy notices should explain what is collected, why, on what basis, who receives it, and how long it is kept.
Individual Rights
Organisations should maintain processes for requests such as access, rectification, erasure, restriction, portability, and objection. Requests generally require a response within one month, subject to permitted extensions and exemptions.
Personal Data Breach Management
A notifiable personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Affected individuals must also be told where the breach is likely to result in a high risk to them.
International Data Transfers
Transfers of personal data outside the UK need a valid mechanism, such as UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or binding corporate rules, supported by a transfer risk assessment where required.
UK Representative and Governance Roles
Organisations outside the UK that offer goods or services to, or monitor, individuals in the UK may need to appoint a UK representative under Article 27. Some organisations must also appoint a Data Protection Officer, and most controllers must pay the ICO's data protection fee.
An EU representative does not satisfy the UK requirement, and a UK representative does not satisfy the EU one. Organisations covered by both regimes may need both.
Individual Rights Under the UK GDPR
Individuals have a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Individuals should be told how and why their personal data is used, usually through a privacy notice.
Right of Access
Individuals may request a copy of their personal data and information about how it is processed.
Rectification and Erasure
Individuals may ask for inaccurate data to be corrected and, in certain circumstances, for their data to be erased.
Restriction and Objection
Individuals may ask for processing to be restricted or object to it, including an absolute right to object to direct marketing.
Data Portability
Where applicable, individuals may receive their data in a structured, commonly used, machine-readable format.
Automated Decision-Making
Safeguards apply to significant decisions based solely on automated processing, as amended by the Data (Use and Access) Act 2025.
Requests generally require a response within one month. Organisations should assess which rights and exemptions apply in each case rather than treating every right as absolute.
The UK's Regulatory Timeline
The UK's data protection framework has developed through several stages since 2018.
- May 2018
Data Protection Act 2018
The Data Protection Act 2018 took effect alongside the EU GDPR, which applied in the UK while it remained within the EU framework.
- January 2021
UK GDPR Takes Effect
At the end of the Brexit transition period, the UK GDPR became the UK's own data protection regulation, separate from the EU GDPR.
- March 2022
UK Transfer Tools Introduced
The International Data Transfer Agreement and the UK Addendum to the EU Standard Contractual Clauses came into force for transfers from the UK.
- June 2025
Data (Use and Access) Act
The Data (Use and Access) Act 2025 received Royal Assent, amending the UK GDPR, the Data Protection Act 2018, and PECR, with staged commencement.
Important: provisions of the Data (Use and Access) Act 2025 commence on different dates. Confirm the status of each provision using official sources before changing your compliance programme.
Data Protection Authorities in the United Kingdom
The Information Commissioner's Office (ICO) is the UK's independent data protection authority. It oversees the UK GDPR, the Data Protection Act 2018, and PECR, issues guidance and codes of practice, and can investigate and take enforcement action.
Other regulators may be relevant depending on the activity, including Ofcom for online safety and communications, and the FCA and PRA for financial services. The Data (Use and Access) Act 2025 also provides for the ICO to be replaced by a new Information Commission.
Organisations should identify which regulators are relevant to their activities rather than assuming that the ICO is the only authority they deal with.
Penalties for Non-Compliance
Under the UK GDPR, the most serious infringements can attract fines of up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher. Other infringements fall under a lower maximum of £8.7 million or 2% of turnover.
The ICO can also issue information and assessment notices, reprimands, and enforcement notices requiring changes to processing. Individuals may claim compensation for damage, and the Data (Use and Access) Act 2025 raises the maximum fines under PECR to the UK GDPR levels once the relevant provisions are in force.
How RegulatoryBridge Supports Compliance in the United Kingdom
RegulatoryBridge helps organisations assess the UK's regulatory requirements and coordinate their compliance activities with wider international programmes.
UK GDPR Compliance Assessment
Review your processing activities, notices, lawful bases, policies, governance arrangements, and operational controls to identify potential gaps.
UK Representative and Governance Assessment
Determine whether a UK representative or Data Protection Officer is required for your organisation, and how those roles should work alongside any EU arrangements.
Individual Rights and Complaints
Review request-handling processes, response timelines, complaint procedures, and related documentation against the requirements applicable to you.
Breach Response and Incident Coordination
Evaluate incident procedures, escalation responsibilities, ICO notification readiness, and coordination between privacy, security, legal, and communications teams.
International Data Transfers
Assess data flows out of the UK, transfer mechanisms, transfer risk assessments, and vendor contracts, and align them with your EU transfer programme.
Marketing and Cookie Compliance
Review electronic marketing consents, cookie banners, and tracking technologies against PECR and the UK GDPR.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, commencement dates, ICO guidance, or enforcement priorities change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to UK Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to the United Kingdom.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions
Need UK GDPR representation?
We act as your UK representative, support ICO interactions, and help run breach response - so your global product team doesn't have to.