UK and EU divergence
The UK GDPR began as a copy of the EU GDPR. It has since diverged, most sharply through the Data (Use and Access) Act 2025. Ten topics, the EU baseline, the UK position, and whether the UK change is in force. The EU GDPR appears here only as the comparison baseline.
| Topic | EU GDPR | UK position | Status | Commenced |
|---|---|---|---|---|
| Lawful bases | Six bases in Art 6(1). Legitimate interests always needs the three-part test: purpose, necessity and a balance against the individual's interests. | Adds recognised legitimate interests: for purposes listed in the new Annex 1 (such as national security, emergencies, crime prevention and safeguarding) no balancing test is needed. Outside the list the ordinary three-part test is unchanged. | In force | 2026-02-05 |
| Automated decisions | Art 22: a general prohibition on decisions based solely on automated processing with legal or similarly significant effects, subject to three exceptions (contract, law, explicit consent). | Arts 22A to 22D replace Art 22 with a safeguards model: significant solely automated decisions are permitted if safeguards are in place (information, the ability to make representations, human intervention and the ability to contest), with tighter limits where special category data is involved. Decisions taken before 2026-02-05 under the old safeguards are not caught by the new provisions (SI 2026/82 reg 5). | In force | 2026-02-05 |
| Subject access | Art 15 access right, one month to respond, extendable by two months. No codified limit on the search a controller must carry out. | Access is limited to what a reasonable and proportionate search can find (s.78, treated as in force from 2024-01-01). Time limits, including stopping the clock while waiting for identity or clarification, are codified (s.76, for requests received from 2026-02-05). | In force | 2025-06-19 |
| Complaints | Right to lodge a complaint with a supervisory authority (Art 77). No statutory duty on controllers to run their own complaints process. | Controllers must have a process for data protection complaints (new DPA 2018 s.164A), so the controller is the first stop and the regulator the second. Applies to complaints received on or after 2026-06-19 (SI 2026/82 reg 7). The controller must acknowledge a complaint within 30 days of receiving it (s.164A(3)). | In force | 2026-06-19 |
| Regulator | Independent supervisory authorities in each member state, coordinated through the EDPB, with the one-stop-shop for cross-border processing. | One regulator for the whole UK, the Information Commission, a board that succeeded the Information Commissioner on 2026-09-30. Outside the EDPB and the one-stop-shop. | In force | 2026-09-30 |
| Cookies and PECR | ePrivacy Directive Art 5(3): consent for storing or accessing information on a device, except where strictly necessary or solely for transmission. | PECR reg 6 now has consent exceptions for listed low-risk purposes, including analytics, on conditions. PECR penalties match the UK GDPR ceiling. | In force | 2026-02-05 |
| Research | Scientific research is not defined in the articles; Recital 159 reads it broadly and Recital 33 contemplates consent to areas of research. Safeguards in Art 89. | A statutory meaning of research and statistical purposes that expressly covers commercially funded research, consent to an area of scientific research, and a reworked set of research safeguards. | In force | 2026-02-05 |
| International transfers | Adequacy under Art 45 requires an "essentially equivalent" level of protection, as read by the CJEU in Schrems I and II. Art 46 safeguards otherwise. | Transfers turn on the "data protection test": protection in the destination must not be materially lower than in the UK. Applies both to the Secretary of State's adequacy regulations and to controllers using safeguards such as the IDTA. | In force | 2026-02-05 |
| Children's data | Art 8 digital consent age of 16, which member states may lower to no less than 13. No express children's duty in Art 25. | Digital consent age of 13. Data protection by design must account for children's higher protection matters where an online service is likely to be accessed by children, alongside the Age Appropriate Design Code (DPA 2018 s.123). | In force | 2026-02-05 |
| Immigration and national security | Restrictions only through member state law meeting Art 23. National security falls outside EU competence and the GDPR's scope. | DPA 2018 Sch 2 para 4 immigration exemption, with the safeguards written into the Act by SI 2024/342 after the Open Rights Group litigation; national security exemption and certificates in the DPA 2018. The DUAA amended the national security provisions in Parts 3 and 4 (ss.88 to 90). Since REULA 2023, a Sch 2 exemption prevails over Art 23 where the two cannot be read together; the DPA 2018 page sets out why and how to apply it. | In force | 2025-11-17 |
Sources
- Primary Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) legislation.gov.uk
- Primary Data (Use and Access) Act 2025, section 78 legislation.gov.uk
- Regulator Information Commission succeeds the ICO as UK's data protection regulator GOV.UK
- Primary Data Protection Act 2018 (c. 12) legislation.gov.uk
- Regulator Data (Use and Access) Act 2025, plans for commencement GOV.UK (DSIT)