UK GDPR — United Kingdom General Data Protection Regulation

Why does it matter?

The UK GDPR applies to any business that handles personal data of people in the UK, whether or not the business is based there. For infringements of the principles, the lawful bases and consent rules, the data subject rights, the automated decision-making restrictions and the transfer rules, Article 83(5) allows fines of up to 17.5 million pounds or 4 percent of total worldwide annual turnover, whichever is higher. Breaches of the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43 carry up to 8.7 million pounds or 2 percent (Article 83(4)). Article 82 gives individuals a right to compensation for material or non-material damage.

Key benefits include:

• A named set of principles

Article 5(1) lists lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation and integrity and confidentiality, with accountability in Article 5(2).

• Six lawful bases plus one

Article 6(1) lists consent, contract, legal obligation, vital interests, public task and legitimate interests, and since February 5, 2026 recognized legitimate interests in point (ea).

• Clock-based rights

Articles 12 and 12A give a controller one month from the relevant time to act on a request, extendable by two further months where requests are complex or numerous.

• A fixed breach clock

Article 33 requires notification to the Commission without undue delay and where feasible within 72 hours of becoming aware of a breach.

• A transfer test

Article 44A allows a restricted transfer only if approved by regulations, made with appropriate safeguards or covered by a derogation.

How does it work?

Processing starts with Article 5 and a lawful basis under Article 6. Article 6(1)(ea), inserted by the Data (Use and Access) Act 2025, allows processing necessary for a recognized legitimate interest, which Annex 1 limits to disclosures for a public task request, national security, public security and defense, emergencies, crime and safeguarding vulnerable individuals; Articles 6(1)(ea) and (f) do not apply to public authorities performing their tasks. Special category data needs an Article 9 condition. A child must be at least 13 for consent to an information society service to be lawful without parental authorization (Article 8).

Rights run from Article 12. A controller must act on a request without undue delay and before the end of the applicable time period, which is one month from the latest of receipt, receipt of requested identification or information, and payment of any fee (Article 12A). Article 15(1A) limits a subject access response to what a reasonable and proportionate search finds. Where a controller needs more information to find the data, the time between asking and receiving it does not count toward the period. Articles 22A to 22D restrict significant decisions based solely on automated processing and require safeguards: information, representations, human intervention and a way to contest.

The controller's duties follow. Records of processing are required except for organizations with fewer than 250 employees unless the processing is risky, not occasional or includes special category or criminal offence data (Article 30(5)). A data protection impact assessment is required before high-risk processing (Article 35), a data protection officer for public authorities and for core activities involving large-scale monitoring (Article 37), and a representative in the UK for organizations outside it that fall under Article 3(2) (Article 27).

Key Elements

• Principles and accountability (Article 5)

Six principles plus the controller's duty to demonstrate compliance.

• Lawful bases (Article 6 and Annex 1)

Consent, contract, legal obligation, vital interests, public task, recognized legitimate interests and legitimate interests.

• Data subject rights (Articles 12 to 22D)

Information, access with a reasonable and proportionate search, rectification, erasure, restriction, portability, objection and the automated decision-making safeguards.

• Controller and processor duties (Articles 24 to 39)

Records (30), security (32), breach notification to the Commission within 72 hours (33), impact assessments (35) and data protection officers (37).

• Transfers (Articles 44A to 49A)

Approved by regulations under Article 45A on a data protection test (45B), subject to appropriate safeguards (46), or within a derogation (49).

• Penalties and redress (Articles 82 and 83)

Fines of up to 17.5 million pounds or 4 percent, or 8.7 million pounds or 2 percent, and a right to compensation.

What does it cover?

Article 3(1) applies the regulation to processing in the context of the activities of a UK establishment of a controller or processor, wherever the processing takes place. Article 3(2) applies it to controllers and processors without a UK establishment where the processing relates to offering goods or services, with or without payment, to people in the UK or monitoring their behavior in the UK. Article 2 excludes purely personal or household activity, processing by a competent authority for law enforcement purposes and intelligence services processing, which Parts 3 and 4 of the Data Protection Act 2018 cover instead.

What are its objectives?

Article 1 states what the regulation is for.

Lay down rules for the protection of natural persons with regard to the processing of personal data and for the free movement of personal data.

Contribute to the protection of individuals' fundamental rights and freedoms.

Require processing to be lawful, fair, transparent and limited to specified purposes (Article 5).

Give individuals clock-bound rights over their data and a route to complain to the controller and to the Commission.

Hold controllers accountable through records, assessments, security, breach notification and proportionate penalties.

Framework in Context

The UK GDPR sits beside the Data Protection Act 2018, which defines the term in section 3(10) and supplies Schedule 1 conditions, exemptions, the law enforcement and intelligence regimes, and the enforcement powers; penalty procedure and maximum amounts are in sections 155 to 157 of the Act. It follows the structure of the EU GDPR, but the UK text now differs, with UK-specific provisions such as the 13-year consent age in Article 8, a UK representative in Article 27 and the transfer rules in Articles 44A to 49A. The Commission's guidance and codes of practice explain how it applies, and since September 30, 2026 the Act refers to the Commission, not the Information Commissioner.

Common Framework Mappings

Organizations map the UK GDPR's articles to the frameworks below so that one record of processing, one set of assessments and one evidence trail serve the UK, the EU and other privacy laws.

Mapped frameworks include:

APEC CBPR System

CCPA/CPRA

UK DPA 2018

GDPR

ISO 27001:2022

ISO 27701

ISO 29100

NIST Privacy Framework v1.0