UK GDPR, data protection after Brexit
Know how UK rules compare with the EU’s and what you need to do for UK customers.
Official sources
Use these official places to read the text and find the latest version.
What UK GDPR is
After the UK left the EU, the EU GDPR was kept in UK law as the UK GDPR, working together with the Data Protection Act 2018. Most principles and rights are the same as the EU’s.
The Data (Use and Access) Act 2025 updates parts of the law, and the government is bringing its provisions into force in stages.
How UK GDPR got to where it is today
The milestones that changed what organisations have to do.
Data Protection Act
The UK’s first modern data protection law.
DPA 2018 and EU GDPR
The Act and the GDPR apply together.
UK GDPR
The UK GDPR applies from the end of the transition period.
Data (Use and Access) Act
The Data (Use and Access) Act 2025 receives Royal Assent on 19 June 2025 and updates parts of UK data protection law.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You have customers or staff in the UK.
You send data between the UK and EU.
You use UK vendors.
You need a UK representative.
What it asks of you
The requirements fall into six areas.
Principles and lawful basis
Same core principles as GDPR.
Individual rights
Access, correction, erasure and more.
Accountability
Records, DPIAs, DPO where needed.
Security and breaches
Report to the ICO within 72 hours.
International transfers
UK transfer tools.
Registration
Pay the ICO data protection fee.
The 6 parts, 15 areas and 63 obligations of UK data protection law
The UK GDPR keeps the EU text with UK adaptations, sits beside the Data Protection Act 2018, and was amended by the Data (Use and Access) Act 2025. This page paraphrases what each asks of you.
15 article groups · 63 obligations
uk-p1Principles and lawful basesThe UK GDPR keeps the seven EU principles and six lawful bases, with UK-specific rules in the DPA 2018.3 article groups · 16 obligations
- Art. 5(1)(a)
Process personal data lawfully, fairly and transparently.
What you do
- Record a lawful basis for each purpose
- Publish a clear privacy notice
- Art. 5(1)(b)
Collect data for specified, explicit and legitimate purposes and do not use it in incompatible ways.
What you do
- Document purposes in the register
- Run a compatibility check for new uses
- Art. 5(1)(c)
Keep data adequate, relevant and limited to what is necessary.
What you do
- Trim forms to essential fields
- Review data held at each system
- Art. 5(1)(d)
Keep data accurate and up to date.
What you do
- Let people correct their details
- Run periodic data quality checks
- Art. 5(1)(e)
Keep identifiable data only as long as needed.
What you do
- Set and apply retention periods
- Automate deletion
- Art. 5(1)(f)
Keep data secure against unauthorised access, loss and damage.
What you do
- Use access control and encryption
- Test backups
- Art. 5(2)
Be able to demonstrate compliance with the principles.
What you do
- Keep policies, training and decision logs
- Name an accountable owner
Evidence to keep
- Records of processing
- Privacy notice
- Retention schedule
- Accountability file
- Art. 6(1)
Rely on at least one lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests.
What you do
- Record the basis per purpose
- Do not change basis later without reassessment
- Art. 6(1)(f)
If relying on legitimate interests, record a purpose, necessity and balancing assessment.
What you do
- Complete a legitimate interests assessment
- Offer an objection route
- DPA 2018 s. 8
Where relying on public task or official authority, make sure it covers functions in the public interest set out in UK law as listed in the Act.
What you do
- Document the legal source of the task
- Limit use to that task
- Art. 7
Make consent freely given, specific, informed and unambiguous, keep proof, and make withdrawal as easy as giving it.
What you do
- Use opt-in boxes with granular choices
- Log consent history
- Art. 8 and DPA 2018 s. 9
For online services offered directly to a child, obtain parental authorisation if the child is under 13, the UK age threshold.
What you do
- Verify age proportionately
- Apply the ICO Children's code (Age-appropriate design code) where children are likely users
Evidence to keep
- Lawful basis register
- Legitimate interests assessments
- Consent records
- Age-appropriate design assessment
- Art. 9
Do not process special category data unless you have an Article 6 basis and an Article 9 condition.
What you do
- Record both for each use
- Limit access to a named few
- DPA 2018 Sch. 1 Part 1
Where you rely on employment, health, public health or research conditions, meet the extra conditions and safeguards set in Schedule 1.
What you do
- Check the exact condition wording
- Record the condition used
- DPA 2018 Sch. 1 Part 4
Keep an appropriate policy document when relying on many Schedule 1 conditions, describing procedures and retention for the data.
What you do
- Write and review an APD
- Keep earlier versions for the required period
- Art. 10 and DPA 2018 s. 10
Process criminal conviction and offence data only under official authority or a UK-law condition with safeguards.
What you do
- Limit background checks to the lawful cases
- Restrict access
Evidence to keep
- Special category inventory
- Article 9 condition record
- Appropriate policy document
- Criminal offence data log
uk-p2Individual rights and transparencyRights are the same as the EU text, run through UK law and the ICO.3 article groups · 13 obligations
- Art. 12(1)
Give information in concise, clear and accessible language.
What you do
- Write plain-English notices
- Test readability
- Art. 12(3)
Respond to requests within one month, extendable by up to two months for complex or numerous requests with notice.
What you do
- Log receipt date and deadline
- Use a case-management tool
- Art. 13
Provide required privacy information at the point of collecting data directly.
What you do
- Link the notice at every collection form
- Keep version history
- Art. 14
Provide the same information within one month when you obtain data from another source.
What you do
- Add notice steps for third-party data
- Check exceptions before relying on them
Evidence to keep
- Privacy notices
- Request log with deadlines
- Identity verification procedure
- Art. 15
Give people confirmation, a copy of their data and supporting information (subject access).
What you do
- Search all systems
- Redact third-party information as the law allows
- Art. 16
Correct inaccurate data and complete incomplete data.
What you do
- Provide an update route
- Notify recipients
- Art. 17
Erase data where a ground applies, subject to exceptions.
What you do
- Maintain a deletion runbook including backups
- Record exceptions
- Art. 18
Restrict processing on request in the listed circumstances.
What you do
- Flag restricted records
- Prevent further use
- Art. 20
Provide data supplied by the person in a structured, machine-readable format where processing is by consent or contract and automated.
What you do
- Offer CSV or JSON export
- Test completeness
- Art. 21
Stop processing on objection, and always stop direct marketing.
What you do
- Include opt-outs in every message
- Suppress objectors
- Art. 22 (as in force)
Do not make solely automated significant decisions without meeting conditions, and give human review where required.
What you do
- Inventory automated decisions
- Add review and appeal route
Evidence to keep
- Rights request register
- Erasure logs
- Export samples
- Automated decision register
- DPA 2018 Sch. 2
Use exemptions such as crime and taxation, legal privilege, management forecasts or confidential references only where the conditions are met, and only to the extent needed.
What you do
- Record the exemption and reason
- Review case by case
- DPA 2018 Schs. 3-4
Apply limits on access for health, social work, education and some other records according to the Schedules.
What you do
- Use specialist guidance for sector records
- Involve qualified professionals where required
Evidence to keep
- Exemption decision log
- Legal privilege review notes
uk-p3Accountability and securityGovernance obligations mirror the EU text.4 article groups · 15 obligations
- Art. 24
Put in place measures proportionate to risk and review them.
What you do
- Maintain policies
- Review annually
- Art. 25
Build data protection into design and default settings.
What you do
- Add privacy review to projects
- Default to minimum data
- Art. 26
Set out joint controller responsibilities in a transparent arrangement.
What you do
- Sign a joint controller agreement
- Publish a summary
- Art. 27
If outside the UK but subject to UK GDPR, appoint a UK representative unless exempt.
What you do
- Appoint and publish contact
- Review annually
- Art. 28
Use only processors with sufficient guarantees, under a written contract with mandatory terms.
What you do
- Use a standard DPA
- Keep a sub-processor list
- Art. 30
Keep a record of processing activities, noting exemption for smaller organisations does not cover risky, regular or sensitive processing.
What you do
- Maintain the RoPA
- Review twice yearly
- Art. 31
Cooperate with the Information Commissioner and respond to information notices.
What you do
- Nominate an ICO contact
- Respond within deadlines
- Art. 32
Apply appropriate technical and organisational security measures, including encryption, resilience, recovery and regular testing.
What you do
- Use access control, patching and tested backups
- Run annual security testing
Evidence to keep
- Data protection policy
- DPAs with suppliers
- RoPA
- Joint controller arrangements
- UK representative appointment
- Art. 33
Report a notifiable breach to the ICO without undue delay and within 72 hours of becoming aware, unless unlikely to risk individuals.
What you do
- Define an escalation path
- Prepare an ICO report template
- Art. 33(5)
Record all breaches, effects and actions, whether reported or not.
What you do
- Keep a breach register
- Record the notifiability decision
- Art. 34
Tell affected individuals directly where the breach is likely to result in high risk.
What you do
- Prepare customer templates
- Provide protective advice
Evidence to keep
- Breach plan
- Breach register
- ICO report copies
- Art. 35
Carry out a DPIA before likely high-risk processing, including large-scale profiling, special category data or systematic monitoring.
What you do
- Use a screening checklist
- Refer to the ICO's list of types needing a DPIA
- Art. 36
Consult the ICO before processing if a DPIA shows high risk you cannot reduce.
What you do
- Escalate to the DPO and board
- Keep the consultation file
- Arts. 37-39
Appoint a DPO if you are a public authority or your core activities involve large-scale monitoring or special category data, and support their independence.
What you do
- Assess and record whether required
- Publish contact details and notify the ICO
Evidence to keep
- DPIA register
- DPO appointment
- Prior consultation file
- Charges Regs 2018
Pay the annual data protection fee to the ICO unless exempt, and keep details up to date.
What you do
- Check the fee tier for your size
- Set a renewal reminder
Evidence to keep
- Fee payment receipt
- ICO registration number
uk-p4International transfersUK rules differ from the EU in the instruments you use.1 article group · 4 obligations
- Art. 45
Transfer freely only where UK adequacy regulations cover the destination, including the UK's list of covered countries.
What you do
- Check the current list
- Record the basis
- Art. 46
Use appropriate safeguards where no adequacy applies, such as the ICO's International Data Transfer Agreement, the UK Addendum to EU standard clauses, or binding corporate rules.
What you do
- Sign IDTA or Addendum
- Keep copies
- Transfer risk assessment
Assess whether destination law lets the safeguards work in practice and record the outcome.
What you do
- Complete the ICO's TRA tool
- Add technical measures where needed
- Art. 49
Use derogations only for limited, exceptional transfers.
What you do
- Document why safeguards were unavailable
- Avoid systematic use
Evidence to keep
- Transfer map
- UK adequacy regulations reference
- IDTA or Addendum copies
- Transfer risk assessments
uk-p5ICO, enforcement and remediesThe Information Commissioner's Office regulates; DPA 2018 sets powers and offences.3 article groups · 7 obligations
- DPA 2018 s. 142
Respond to information notices from the ICO within the stated time.
What you do
- Route notices to legal and the DPO
- Keep a copy of responses
- DPA 2018 s. 149
Comply with enforcement notices requiring steps or stopping processing.
What you do
- Track remediation to closure
- Report progress
- DPA 2018 s. 155
Be aware the ICO may issue penalty notices, and these may be appealed to the First-tier Tribunal.
What you do
- Prepare mitigation evidence
- Know the appeal route
Evidence to keep
- Inspection readiness pack
- Regulator correspondence log
- Art. 83 and DPA 2018 s. 157
Understand the maximum fines: the higher tier is up to GBP 17.5 million or 4 percent of worldwide annual turnover, whichever is higher, and the standard tier is up to GBP 8.7 million or 2 percent.
What you do
- Treat principles, rights and transfers as top risks
- Evidence your controls
- DPA 2018 s. 170
Do not knowingly or recklessly obtain, disclose or procure personal data without the controller's consent, which is a criminal offence.
What you do
- Train staff on snooping rules
- Monitor access to records
- DPA 2018 ss. 171-173
Do not re-identify de-identified data without consent, or alter or destroy information to block a subject access request, both offences.
What you do
- Control access to anonymised datasets
- Preserve data subject to a request
Evidence to keep
- Risk register entry
- Staff awareness training record
- Arts. 77-82
Expect individuals to be able to complain to the ICO and to seek court remedy and compensation.
What you do
- Set up an internal complaints process
- Keep defence evidence
Evidence to keep
- Complaints procedure
- Claims log
uk-p6Data (Use and Access) Act 2025 changesThe 2025 Act amends UK GDPR and the DPA 2018 in stages, so check commencement dates before relying on a change.1 article group · 8 obligations
- DUAA: recognised legitimate interests
Where the amended UK GDPR provides a list of recognised legitimate interests (such as safeguarding and crime prevention), use them without the full balancing test, while keeping the other principles.
What you do
- Check each purpose against the official list
- Keep a record of the interest relied on
- DUAA: automated decision-making
Under the reformed rules, allow solely automated significant decisions in more cases but only with safeguards such as information, ability to contest and human intervention, and with tighter limits for special category data.
What you do
- Update the ADM register
- Build a contest and review route
- DUAA: subject access
Search for personal data in a reasonable and proportionate way when handling access requests, and use the clock-stopping rules where you need clarification.
What you do
- Document the scope of searches
- Record any pause and reason
- DUAA: complaints to controllers
Provide a way for people to complain to you directly, acknowledge within the set period and respond without undue delay.
What you do
- Publish a complaints form
- Set an internal response target
- DUAA: international transfers
Meet the amended transfer test, where protection must not be materially lower than in the UK.
What you do
- Update transfer risk assessments
- Review contracts
- DUAA: research and compatibility
Use the clarified definitions for scientific research and the reformed purpose-compatibility rules.
What you do
- Update research governance
- Revisit compatibility checks
- DUAA: PECR and cookies
Follow updated electronic marketing and cookie rules, including new exceptions for low-risk cookies and higher PECR fines aligned with UK GDPR.
What you do
- Review cookie banners
- Check marketing consent flows
- DUAA: ICO governance
Expect the ICO to be restructured into an Information Commission with new powers to require information and interview.
What you do
- Prepare for interview and document requests
- Track commencement
Evidence to keep
- Gap analysis against DUAA changes
- Updated procedures
- Commencement tracker
Nothing matches. Clear the search or pick another part.
Outcomes and implementation examples are from UK GDPR and Data Protection Act 2018 (legislation.gov.uk and ICO guidance), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Map UK data
What and where.
- 2
Review notices
UK wording and contacts.
- 3
Check transfers
UK to EU and rest of world.
- 4
Set breach process
ICO reporting.
- 5
Review yearly
Fee and records.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Principles and lawful basis | Processing register |
| Individual rights | Request tracker |
| Accountability | Policy and DPIA workflows |
| Security and breaches | Incident workflow |
| International transfers | Transfer register |
| Registration | Fee reminder |
Free UK GDPR readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Record of processing
- UK privacy notice starter
- International transfer checklist
- Breach checklist
Share or cite this page
Writing about UK GDPR? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/uk-gdpr/">UK GDPR explained in plain English - Optimus CyberX</a>Common questions
Is it the same as EU GDPR?
Very close, with differences in transfers and some details.
Do we need both?
If you serve both UK and EU people, yes.
Who regulates it?
The Information Commissioner’s Office (ICO), the UK data protection regulator.
Do we need to register?
Most organisations that handle personal data pay a data protection fee to the ICO unless exempt.
Related frameworks
See how ready you are for UK GDPR
Answer questions across every area. We email you a report showing where you comply and where you do not.