UK GDPR vs. EU GDPR: How They Differ Today

For the first few years after Brexit, "UK GDPR" was essentially a copy-paste of the EU GDPR with different letterhead — the same rules, transplanted into UK law and left largely untouched. That's no longer true. The Data (Use and Access) Act 2025 has spent the past year rewriting real parts of the UK regime — how organizations justify processing data, how automated decisions get made, how cookies get consented to — and the two frameworks are now genuinely diverging in substance, not just in which regulator enforces them. Anyone still explaining UK data protection law as "GDPR, but British" is describing a version of the law that stopped being accurate in early 2026.

Where "UK GDPR" Actually Comes From

UK GDPR is not a new law written from scratch — it's the EU's General Data Protection Regulation as it applied in the UK at the end of the Brexit transition period on 31 December 2020, carried into UK domestic law as "retained EU law" under the European Union (Withdrawal) Act 2018, and then adjusted for domestic operability by a 2019 statutory instrument. It sits alongside the Data Protection Act 2018 (DPA 2018), which supplies UK-specific detail — law enforcement processing, national security exemptions, and the Information Commissioner's enforcement powers, among other things. For its first several years, this arrangement meant the UK and EU regimes were nearly identical in substance, differing mainly in which regulator enforced them. That is the part that has now changed.

The Data (Use and Access) Act 2025: What Actually Changed

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, but its reforms did not all take effect at once — they commenced in stages, and getting the current in-force status right matters, because large parts of it are genuinely new as of only a few months before this article was written.

The bulk of the substantive changes to UK GDPR itself came into force on 5 February 2026:

• A new "recognised legitimate interests" list. UK GDPR now has a closed list of purposes — including public-task disclosures, national security, public security and defence, responding to emergencies, and crime prevention and safeguarding — for which an organization no longer needs to carry out the normal three-part legitimate-interests balancing test. This is a genuinely new shortcut that doesn't exist under the EU GDPR. It's narrower than it might sound: everyday uses like direct marketing, sharing data within a corporate group, and network security remain ordinary legitimate interests that still require the standard balancing test.
• A restructured framework for automated decision-making. New UK GDPR Articles 22A–22D replace the old Article 22, which generally prohibited solely automated decisions with legal or similarly significant effects, subject to narrow exceptions. Under the new structure, solely automated significant decisions based on ordinary personal data are now permitted by default, provided safeguards apply — the right to be informed, the right to obtain human intervention, and the right to contest the decision. Decisions based wholly or partly on special category data (health, biometric, and similar sensitive information) remain under a narrower permission model closer to the old rule. This is a structural divergence from the EU GDPR's Article 22, which the UK has not mirrored.
• New cookie-consent exemptions. The Privacy and Electronic Communications Regulations (PECR) now exempt certain low-risk cookie uses from the normal consent requirement — first-party website analytics, cookies that simply remember a user's display or accessibility preferences, and cookies used to provide emergency assistance — provided users are still given clear information and an easy way to opt out. Third-party-shared analytics cookies still require consent as before. Separately, PECR's maximum fine was raised from a flat £500,000 cap up to the same level as UK GDPR fines (see below).
• A "soft opt-in" for charities. Direct marketing's existing "soft opt-in" exception — allowing an organization to email or text someone who has already shown interest, without needing fresh explicit consent — has been extended to charities and other non-commercial organizations for their own charitable purposes, subject to conditions including that the contact details were collected directly from the individual and every message offers a clear opt-out.
• A new test for international transfers. The UK has replaced the EU-style "essentially equivalent" protection standard with its own statutory "data protection test," asking instead whether a destination country's protections are "not materially lower" than the UK's own. This applies both to the government's own adequacy-style regulations for other countries and to organizations' own transfer risk assessments when relying on safeguards like the UK's International Data Transfer Agreement.

A separate, later change took effect on 19 June 2026: organizations must now have a formal internal complaints-handling procedure for data protection complaints — accepting, acknowledging, investigating, and responding to them — and individuals are generally expected to complain to the organization first before escalating to the regulator. As of this article's publication date, that requirement is already in force.

The Regulator Is Changing Too

DUAA also restructures who enforces all of this. The single Information Commissioner — a "corporation sole," meaning one person legally embodying the office — is being replaced by a board-led body called the Information Commission, with a chair, a chief executive, and non-executive board members. This transition was underway but not yet fully complete as this article was written: a board of non-executive members had been appointed, with recruitment for the permanent chair still open. Because this is a live organizational transition, confirm the Information Commission's current status directly with the regulator before assuming the changeover is finished.

Did the UK Keep Its EU Adequacy Status?

This mattered enormously to any business moving personal data from the EU to the UK. The European Commission's original UK adequacy decisions — one under the GDPR, one under the Law Enforcement Directive — were adopted in June 2021 with a four-year "sunset clause" built in, set to expire in mid-2025. Rather than let them lapse, the Commission extended them administratively for several months specifically so it could assess what the Data (Use and Access) Act 2025 would actually change, consulting the European Data Protection Board along the way. The Commission renewed both adequacy decisions in December 2025, each now running for a longer period than the original four years. In short: the UK's post-Brexit data flows with the EU remain lawful, but the renewal process itself is a reminder that UK adequacy is not permanent or unconditional — it's periodically reassessed against how UK law actually develops.

What Still Separates the Two Regimes, Reform or No Reform

Even before DUAA, and independently of it, UK GDPR and EU GDPR differ in ways that follow directly from Brexit itself:

• Different regulators. The UK's Information Commissioner's Office (transitioning to the Information Commission) enforces UK GDPR alone. Each EU member state has its own data protection authority, coordinated at EU level by the European Data Protection Board.
• No one-stop-shop for the UK. Inside the EU, a company can often deal with a single "lead" regulator for cross-border processing. A UK organization operating across the EU can't use the ICO as a lead authority for its EU-side operations — it has to engage the relevant EU member state regulator directly, commonly in whichever EU country its main EU establishment sits.
• A mirrored, but separate, representative requirement. A non-UK organization with no UK establishment that offers goods or services to, or monitors, people in the UK generally must appoint a UK representative. The same obligation runs the other way under the EU GDPR for non-EU organizations, including UK ones, targeting people in the EU. Many organizations operating on both sides of the Channel end up needing two separate representatives, not one.
• Separate transfer mechanisms. The UK maintains its own International Data Transfer Agreement and a UK-specific Addendum that can be used alongside the EU's Standard Contractual Clauses, while the EU relies on its own, separately updated Standard Contractual Clauses. A transfer arrangement built for one side generally needs its own paperwork for the other.

The Fines: Structurally Identical, Numerically Different

Both regimes keep the same two-tier maximum fine structure. Under UK GDPR, the higher tier is up to £17.5 million or 4% of global annual turnover, whichever is greater; under the EU GDPR, it's up to €20 million or 4% of global annual turnover. The mechanism — a percentage-of-turnover cap alongside a fixed maximum, with the higher figure applying — is identical; the currency and the flat-figure ceiling are the only numeric difference. DUAA separately raised PECR's own maximum fine to match the UK GDPR ceiling, closing what had been a much lower cap for things like unlawful marketing calls and cookie violations.

Sources & Further Reading

• UK GDPR (retained Regulation (EU) 2016/679) and the Data Protection Act 2018
• Data (Use and Access) Act 2025, and the Information Commissioner's Office guidance on its provisions
• European Commission adequacy decisions for the United Kingdom (originally adopted 28 June 2021; renewed December 2025)
• Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025

Practical Next Steps

If your organization handles personal data connected to both the UK and the EU, treat this as two related but separately maintained compliance programs rather than one — confirm which specific UK reforms (recognised legitimate interests, the new automated-decision-making rules, the cookie exemptions, the new transfer test) actually apply to what you do, since several took effect only in early 2026. Check the ICO's current guidance directly given the regulator itself is mid-transition, and revisit your EU and UK representative and transfer-mechanism arrangements to make sure both sides are actually covered rather than assuming one filing covers both. For the general, worldwide picture of how modern data privacy law works, see Data Privacy Law Basics: How Personal Data Is Protected.

This article is general legal information, not legal advice. UK and EU data protection law is changing rapidly — confirm the current position with the Information Commissioner's Office or the European Data Protection Board, and consult a qualified data protection lawyer for advice on your specific situation.