UK GDPR
Amended United Kingdom · In force May 25, 2018 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
The UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.
- Who it applies to
- Controllers and processors established in the UK, and non-UK organisations offering goods/services to, or monitoring, individuals in the UK. No revenue or volume threshold.
- Penalties
- Up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher (lower tier GBP 8.7 million or 2%). Since 5 Feb 2026, PECR fines are aligned to the same UK GDPR levels.
- Enforced by
- Information Commissioner's Office (becoming the Information Commission on 30 Sept 2026)
- Official name
- UK General Data Protection Regulation and Data Protection Act 2018
- Citation
- Data Protection Act 2018 c. 12; UK GDPR (retained Regulation (EU) 2016/679)
- Topics
- privacy, breach-notification
Research notes
See uk-duaa for the full staged commencement of the 2025 amendments. UK adequacy decision from the EU was renewed in 2025 (not separately verified here).
Related
Data (Use and Access) Act
Swiss revised FADP (nFADP)
Turkey KVKKQuestions about UK GDPR
- What are the UK GDPR compliance deadlines?
- May 25, 2018: Data Protection Act 2018 and GDPR apply. Jan 1, 2021: UK GDPR takes effect after Brexit transition. Feb 5, 2026: DUAA amendments to UK GDPR commence.
- When does UK GDPR take effect?
- UK GDPR took effect on May 25, 2018.
- Who does UK GDPR apply to?
- Controllers and processors established in the UK, and non-UK organisations offering goods/services to, or monitoring, individuals in the UK. No revenue or volume threshold.
- What are the penalties under UK GDPR?
- Up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher (lower tier GBP 8.7 million or 2%). Since 5 Feb 2026, PECR fines are aligned to the same UK GDPR levels.