What is the UK GDPR?
When the UK left the EU, the GDPR was kept in UK law as the UK GDPR. It sits alongside the Data Protection Act 2018, which adds UK-specific rules, exemptions and the separate regimes for law enforcement and intelligence processing. The core principles, lawful bases and individual rights mirror the EU GDPR, so organisations already compliant with one start from a strong position for the other.
Who does it apply to?
Organisations established in the UK that process personal data, and organisations outside the UK that offer goods or services to, or monitor, people in the UK. Non-UK organisations caught this way may need a UK representative.
Key duties
- Process personal data lawfully, fairly and transparently, under one of the six lawful bases, and keep to the data protection principles.
- Respect individual rights: access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.
- Apply appropriate security, carry out DPIAs for high-risk processing, keep records of processing, and appoint a DPO where required.
- Report qualifying personal data breaches to the ICO within 72 hours, and to affected individuals where the risk is high.
- Use a valid mechanism for international transfers, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU SCCs.
What is changing?
The Data (Use and Access) Act 2025 amends the UK regime in stages. Examples include changes to automated decision-making rules, recognised legitimate interests, cookies and complaints handling. Check the ICO’s commencement guidance for which changes are in force.
How does it relate to other frameworks?
Most GDPR guidance still applies, but EU-specific mechanisms such as the one-stop-shop do not. ISO/IEC 27701 provides a management-system structure that supports both regimes.
Sources and official references
- UK GDPR guidance and resources — Information Commissioner's Office (official source)
- Data Protection Act 2018 — legislation.gov.uk (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with UK Parliament; enforced by the Information Commissioner's Office (ICO).
