United Kingdom. Comprehensive data protection. Retained EU law (assimilated law)
UK GDPRUnited Kingdom General Data Protection Regulation (UK GDPR) – retained Regulation (EU) 2016/679 as amended
§1Summary
- Synopsis
The UK's core data protection regulation, a domesticated copy of the EU GDPR that sets principles, lawful bases, data subject rights, controller and processor duties and international transfer rules. Since February 2026 it carries the Data (Use and Access) Act 2025 reforms, including recognised legitimate interests, a relaxed automated decision-making regime and a new 'data protection test' for transfers.
- Key themes
- Unique features
Post-DUAA it diverges from the EU GDPR: a list of recognised legitimate interests needing no balancing test, Articles 22A–22D allowing most solely automated decisions with safeguards (stricter for special category data), a 'not materially lower' standard for transfer adequacy, and clarified scientific research and further-processing rules. Fines are capped in sterling (£17.5m).
- SaaS relevance
Applies to SaaS providers established in the UK and, via Art 3(2), to overseas providers offering services to or monitoring people in the UK, who must also appoint a UK representative unless exempt; processors carry direct Art 28/32 duties.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ICO within 72h; individuals without undue delay if high risk
- DPO
- Conditional
- Cross-border transfers
- UK adequacy regulations; IDTA / UK Addendum to EU SCCs; BCRs; derogations; DUAA 'data protection test'
- Maximum penalty
- £17.5m or 4% of worldwide annual turnover (higher)
§3Dates
- Key dates
- Adopted
- In force
- EU GDPR applied in UK 2018-05-25; became UK GDPR on 2021-01-01 via EU (Withdrawal) Act 2018 and DPPEC (EU Exit) Regs 2019; substantially amended by Data (Use and Access) Act 2025 (main Part 5 changes commenced 2026-02-05; complaints duty 2026-06-19)
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Information Commissioner's Office (ICO)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EU adequacy (GDPR and LED decisions of 28 June 2021) renewed by the Commission on 19 December 2025; the renewed decisions run until 27 December 2031 subject to review. Retained EU law is now termed 'assimilated law' under the Retained EU Law (Revocation and Reform) Act 2023.