The UK GDPR is the EU General Data Protection Regulation (Regulation (EU) 2016/679) as it was retained in UK domestic law at the end of the Brexit transition period and then textually amended ("onshored") by the 2019 EU Exit Regulations. It is not a free-standing code: it cannot be read alone and operates only in tandem with the Data Protection Act 2018 (instrument id dpa2018), which supplies the definitions, exemptions, criminal offences, enforcement powers and the regulator's constitution. The single most common error in UK privacy writing is to treat "UK GDPR" as a complete statute, the principles, lawful bases and rights live in the Regulation, but the operative detail (Schedules 2-4 exemptions, the s.155 penalty ceiling, the criminal offences) lives in the DPA 2018. Since 2026-02-05 it has been materially amended by the Data (Use and Access) Act 2025, whose data protection Part has been fully in force since 2026-06-19.
Identity
Citation
Regulation (EU) 2016/679 as retained and amended by the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419)
Jurisdiction
United Kingdom
Regime
Data protection
Applies to
England and Wales, Scotland, Northern Ireland
Type
Primary legislation
Structure
Retains the GDPR's 11 Chapters / 99 Articles structure, read with the DPA 2018 (7 Parts, 20 Schedules).
Royal assent
2016-04-27
Main commencement
2021-01-01
Applied as retained EU law from IP completion day (2020-12-31, 23:00 GMT). The 2019 EU Exit Regulations took effect at that point. The Data (Use and Access) Act 2025 amended it in stages: the Art 15 search standard at Royal Assent (treated as in force from 2024-01-01); the main data protection tranche on 2026-02-05 (SI 2026/82); the controller complaints duty on 2026-06-19 (SI 2026/82 reg 3); and a new Art 17(1)(g) erasure ground by SI 2026/317. See the commencement tracker.
Amended by: Amended most significantly by the Data (Use and Access) Act 2025. In force from 2026-02-05 (SI 2026/82): recognised legitimate interests (Sch 4); automated decision-making recast as Arts 22A to 22D (s.80, Sch 6); the research and statistical purposes definition and broad consent for research (ss.67, 68); children's higher protection matters in data protection by design (s.81); the transfers "data protection test" (s.85, Sch 7); and the new time limits for responding to requests (s.76). The controller complaints duty followed on 2026-06-19. The ten-row UK and EU comparison is on the divergence page.
Reads together with
Data Protection Act 2018
Indispensable companion. Supplies Part 2 (general processing supplementing the UK GDPR), the Schedules 2-4 exemptions and their trigger conditions, the s.155 penalty ceiling, the criminal offences (ss.170, 171, 173, 184, 132), s.198 director liability, and the Information Commissioner's constitution. The UK GDPR is legally incomplete without it.
Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)
Lex specialis for electronic marketing, cookies and similar tracking. Where PECR applies to a processing activity it takes precedence over the general UK GDPR rules on that activity.
UK and EU divergence
Where the UK GDPR now departs from the EU GDPR it was copied from. Each row is tied to a commencement record.
The same table, with sources, is on the divergence page.
Topic
EU GDPR
UK position
Status
Lawful bases
Six bases in Art 6(1). Legitimate interests always needs the three-part test: purpose, necessity and a balance against the individual's interests.
Adds recognised legitimate interests: for purposes listed in the new Annex 1 (such as national security, emergencies, crime prevention and safeguarding) no balancing test is needed. Outside the list the ordinary three-part test is unchanged.
In force
Automated decisions
Art 22: a general prohibition on decisions based solely on automated processing with legal or similarly significant effects, subject to three exceptions (contract, law, explicit consent).
Arts 22A to 22D replace Art 22 with a safeguards model: significant solely automated decisions are permitted if safeguards are in place (information, the ability to make representations, human intervention and the ability to contest), with tighter limits where special category data is involved.
In force
Subject access
Art 15 access right, one month to respond, extendable by two months. No codified limit on the search a controller must carry out.
Access is limited to what a reasonable and proportionate search can find (s.78, treated as in force from 2024-01-01). Time limits, including stopping the clock while waiting for identity or clarification, are codified (s.76, for requests received from 2026-02-05).
In force
Complaints
Right to lodge a complaint with a supervisory authority (Art 77). No statutory duty on controllers to run their own complaints process.
Controllers must have a process for data protection complaints (new DPA 2018 s.164A), so the controller is the first stop and the regulator the second.
In force
Regulator
Independent supervisory authorities in each member state, coordinated through the EDPB, with the one-stop-shop for cross-border processing.
One regulator for the whole UK, the Information Commission, a board that succeeded the Information Commissioner on 2026-09-30. Outside the EDPB and the one-stop-shop.
In force
Cookies and PECR
ePrivacy Directive Art 5(3): consent for storing or accessing information on a device, except where strictly necessary or solely for transmission.
PECR reg 6 now has consent exceptions for listed low-risk purposes, including analytics, on conditions. PECR penalties match the UK GDPR ceiling.
In force
Research
Scientific research is not defined in the articles; Recital 159 reads it broadly and Recital 33 contemplates consent to areas of research. Safeguards in Art 89.
A statutory meaning of research and statistical purposes that expressly covers commercially funded research, consent to an area of scientific research, and a reworked set of research safeguards.
In force
International transfers
Adequacy under Art 45 requires an "essentially equivalent" level of protection, as read by the CJEU in Schrems I and II. Art 46 safeguards otherwise.
Transfers turn on the "data protection test": protection in the destination must not be materially lower than in the UK. Applies both to the Secretary of State's adequacy regulations and to controllers using safeguards such as the IDTA.
In force
Children's data
Art 8 digital consent age of 16, which member states may lower to no less than 13. No express children's duty in Art 25.
Digital consent age of 13. Data protection by design must account for children's higher protection matters where an online service is likely to be accessed by children, alongside the Age Appropriate Design Code (DPA 2018 s.123).
In force
Immigration and national security
Restrictions only through member state law meeting Art 23. National security falls outside EU competence and the GDPR's scope.
DPA 2018 Sch 2 para 4 immigration exemption, with the safeguards written into the Act by SI 2024/342 after the Open Rights Group litigation; national security exemption and certificates in the DPA 2018. The DUAA amended the national security provisions in Parts 3 and 4 (ss.88 to 90).
In force
Track changes since 2025
What the Data (Use and Access) Act 2025 changed here, before and after, with the date each took effect.
All tracked changes
Six lawful bases. Legitimate interests always needs the balancing test against the interests and rights of the person.
After
Seven lawful bases. A recognised legitimate interest listed in Annex 1 needs no balancing test, only a condition in Annex 1.
Effect summary in the site's own words, not statutory text.
processing is necessary for the purposes of a recognised legitimate interest;
UK GDPR Art 6(1)(ea). Exact wording, retrieved 2026-11-08. Contains public sector information licensed under the Open
Government Licence v3.0.
Time limits for responding Art 12 In force from 2026-02-05
Before
One month to respond, extendable by two months. Pausing the clock for identity or clarification rests on guidance.
After
One month to respond, extendable by two months. The clock stops by statute while the controller reasonably waits for identity or clarification.
Effect summary in the site's own words, not statutory text.
Right of access to the personal data and the supplementary information, with no codified limit on the search.
After
Right of access limited to what the controller can provide based on a reasonable and proportionate search.
Effect summary in the site's own words, not statutory text.
Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search.
A right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, unless one of three exceptions applies.
After
Decisions based solely on automated processing with legal or similarly significant effects are permitted with safeguards, with tighter limits where special category data is used.
Effect summary in the site's own words, not statutory text.
there is no meaningful human involvement in the taking of the decision
Data protection by design and by default, with no express reference to children.
After
Data protection by design and by default must take account of children's higher protection matters where a service is likely to be accessed by children.
Effect summary in the site's own words, not statutory text.
Transfers assessed against the inherited EU standard of essentially equivalent protection.
After
Transfers assessed against the data protection test: protection not materially lower than in the UK.
Effect summary in the site's own words, not statutory text.
Asymmetry checklist
Ten questions every profile answers explicitly. "None found" means the point was examined and the
instrument has nothing distinctive on it.
#
Point
Finding
Notes
1
Territorial extent
None found
The UK GDPR and DPA 2018 extend uniformly to England, Wales, Scotland and Northern Ireland; data protection is a reserved matter. No region is carved out. Some DPA 2018 provisions make minor Scotland-specific adjustments for devolved public authorities, but the substantive regime does not fork by region.
2
Commencement
Asymmetry found
The Data (Use and Access) Act 2025 amendments commenced in stages rather than at once. The main tranche commenced 2026-02-05 (SI 2026/82) and the complaints duty on 2026-06-19 (SI 2026/82 reg 3), with transitional rules: the new time limits do not apply to requests received before 2026-02-05, and the complaint-handling duties apply only to complaints received from 2026-06-19. Check the commencement record for each provision rather than assuming every DUAA change is live.
3
Sunset / mandatory review
Asymmetry found
No sunset on the instrument itself. However, the EU adequacy decision covering UK-bound transfers carries a sunset clause (renewed 2025-12-19, running to 2031-12-27), which functions as a de facto external review point on UK divergence.
4
Criminal liability
Asymmetry found
The criminal track is not in the UK GDPR; it sits in the DPA 2018 (ss.170, 171, 173, 184, 132). All are fine-only, custody is NOT available for any UK data protection offence. This is a deliberate design choice distinguishing regulatory fines (civil monetary penalties) from the criminal offences, which are triable and carry unlimited fines but no imprisonment.
5
Civil liability
Asymmetry found
Article 82 UK GDPR and s.168 DPA 2018 give a private right of action independent of the ICO. Individuals may claim compensation for both material and non-material damage (distress). Claims are brought in the ordinary civil courts, not before the regulator.
6
Regulatory enforcement toolkit
None found
The regulator's toolkit and ceiling sit in the DPA 2018 (information notices, assessment notices, enforcement notices, penalty notices) with the s.155 ceiling of the higher of £17.5m or 4% of global annual turnover. DUAA 2025 added interview notices and a power to require a report (in force 2026-02-05), and replaced the Information Commissioner with the Information Commission on 2026-09-30 (SI 2026/1015).
7
Personal / director liability
Asymmetry found
Director/officer liability is carried by s.198 DPA 2018, under which offences committed with the consent, connivance or neglect of a director or similar officer expose that individual personally. This is a criminal route, separate from corporate regulatory fines.
8
Public vs private sector split
Asymmetry found
The DPA 2018 splits the regime by processing purpose: Part 2 (general/UK GDPR), Part 3 (law enforcement processing) and Part 4 (intelligence services). The UK GDPR itself governs general processing; law enforcement and intelligence processing fall under the separate Parts.
9
Legal-person coverage
None found
Protects natural persons only. Personal data means data relating to an identified or identifiable living individual. Legal persons are not data subjects, consistent with the GDPR.
10
Exemptions, with their conditions
Asymmetry found
The Regulation's Article 23 restriction power is exercised almost entirely through the DPA 2018, so the operative exemption regime lives in Schedules 2-4 of the companion Act rather than in the UK GDPR text itself (cross-refer dpa2018). Most are conditional prejudice or necessity tests applied case by case, crime and taxation, for instance, bites only to the extent that compliance would be likely to prejudice those purposes, with a smaller number of absolute carve-outs. A reader of the UK GDPR alone sees essentially no exemptions; that is the asymmetry.
Exemptions
Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case
rather than blanket carve-outs.
DPA 2018 Sch.2 Part 1 para 2, Crime and taxation
Trigger
Not automatic. Applies only to the extent that applying the listed UK GDPR provisions would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax. It is a case-by-case prejudice test applied by the controller, not a blanket carve-out.
Disapplies
listed transparency and subject-access provisions
The prejudice test, not the mere existence of the exemption, is the answer a practitioner needs.
Interactions and conflicts
The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a
question about this Act is found in a different one.
Instrument
Relationship
Note
Data (Use and Access) Act 2025
Amended by
Amended in place from 2026-02-05: recognised legitimate interests, purpose limitation, subject access, automated decisions, children's higher protection matters and transfers. See the track changes.
Data Protection Act 2018
Reads with
The DPA 2018 prevails on any point of operative detail it supplies (exemptions, offences, penalty ceiling, regulator powers). The UK GDPR supplies the principles, lawful bases and rights.
PECR 2003
Lex specialis
PECR prevails over the general UK GDPR rules for electronic marketing and cookies; where PECR sets a specific consent rule, that rule governs that activity.
Questions answered
The questions this instrument most often raises, with the answer and the authority for it.
Does the DUAA put EU adequacy at risk?
Not as enacted. The European Commission renewed both UK adequacy decisions on 2025-12-19 after assessing the UK GDPR as amended by the DUAA 2025, taking account of the EDPB's opinion of 2025-10-16. They run to 2031-12-27 with a review after four years, so personal data continues to flow from the EU and EEA to the UK without further safeguards. The Commission monitors UK developments continuously and can suspend, amend or repeal a decision if later changes mean protection stops being essentially equivalent.
Information CommissionUK-wide regulator for data protection and PECR, and for FOIA 2000 and EIR 2004. Succeeded the Information Commissioner on 2026-09-30.
Court of SessionScotland's supreme civil court. Hears appeals on points of law from the Scottish Information Commissioner, and data protection compensation claims in Scotland.