The UK General Data Protection Regulation (UK-GDPR) is the United Kingdom’s post-Brexit data protection law. Effective January 1, 2021, it replaced the EU’s GDPR for UK residents and is administered by the Information Commissioner’s Office (ICO). While substantially similar to EU-GDPR, UK-GDPR operates as independent legislation with evolving guidance. If you process personal data of UK residents, here is what compliance actually looks like in practice.
UK-GDPR vs EU GDPR: Same DNA, Different Law
Think of UK-GDPR as a fork of the EU GDPR taken in 2021. The core concepts are identical: personal data, controllers and processors, six lawful bases, data subject rights, breach reporting. But the two laws now evolve separately, and that divergence is growing:
- EU GDPR is interpreted by the European Data Protection Board and the Court of Justice of the EU.
- UK-GDPR is interpreted by the ICO and UK courts, which are not bound by new EU rulings.
- Guidance is drifting apart. The ICO has its own approach to areas like international transfers, legitimate interests, and AI and data protection, and it updated its international transfer guidance in early 2026.
- One law can cover you twice: if you serve both UK and EU customers, you may need to comply with both regimes at the same time, because UK-GDPR covers UK residents and EU-GDPR covers EU residents.
For most small businesses the practical rules still look alike, which is good news. But “we are GDPR compliant” stopped being a complete answer the day Brexit took effect.
Who Must Comply
UK-GDPR applies to organizations that process personal data of people in the UK, with the usual controller and processor logic:
- Organizations based in the UK processing any personal data.
- Organizations outside the UK that offer goods or services to UK residents, or monitor their behavior. If you run an online store that ships to the UK, or a SaaS with UK customers, UK-GDPR reaches you.
- Processors acting on behalf of UK controllers have direct obligations too, not just contractual ones.
Distance selling is the big trigger for non-UK businesses. Selling to UK customers means collecting their names, addresses, and payment data, which is exactly the activity UK-GDPR regulates. There is no size threshold for the law applying, though small businesses get lighter enforcement attention in practice.
The Six Lawful Bases, Briefly
Every use of personal data needs a lawful basis, and you must pick it before you start processing. The six bases under UK-GDPR:
- Consent: clear, specific, freely given, and withdrawable. Best for marketing and cookies.
- Contract: processing needed to deliver something the person signed up for, like shipping an order.
- Legal obligation: required by law, such as tax record keeping.
- Vital interests: rare, and usually an emergency situation.
- Public task: relevant mostly to public authorities.
- Legitimate interests: the flexible one, but it requires a balancing test against people’s rights. Best for fraud prevention, security, and some analytics.
Consent is not the default answer for everything. In fact, for most routine business processing, contract or legitimate interests fit better. Consent fatigue is real, and over-asking for consent makes the consent you do need less meaningful.
International Transfers: The Part That Changed
This is where UK-GDPR differs most from the EU version in practice. Sending personal data out of the UK requires a valid transfer mechanism, and the UK has built its own set:
- UK adequacy regulations: the UK government has recognized a list of countries and sectors as adequate, including all EU and EEA states, Canada (commercial), Japan, South Korea, New Zealand, and others. Transfers to those destinations can proceed without extra safeguards.
- UK-US Data Bridge: since October 2023, the UK Extension to the EU-US Data Privacy Framework lets UK organizations transfer data to US companies certified under the framework, without case-by-case safeguards.
- UK International Data Transfer Agreement (IDTA) and Addendum: for transfers that do not rely on adequacy, the UK’s own transfer agreement or the UK addendum to the EU’s standard contractual clauses are the workhorse mechanisms.
- Transfer risk assessments: before relying on a transfer mechanism, you assess the risk in the destination country, following ICO guidance updated in January 2026.
The practical version for a small business: check whether your tools (email provider, analytics, support desk, cloud hosting) store data in the UK or a country with UK adequacy. If they do not, confirm they offer the IDTA or the UK-US Data Bridge route before you sign up.
Your Privacy Notice Under UK Law
A UK privacy notice must tell people, in plain language:
- Who you are and how to contact you and your data protection officer if you have one
- What data you collect and why, mapped to your lawful bases
- Who you share it with, including processors and any international transfers
- How long you keep it
- Their rights, including access, rectification, erasure, restriction, portability, and objection
- How to complain to the ICO
The ICO publishes templates and expects notices to be layered: a short version up front with detail available underneath, not a single wall of legal text. If your privacy policy was written for EU-GDPR in 2018 and never touched since, it is probably due for a UK-specific refresh.
DSARs and the One-Month Clock
When someone requests access to their data (a data subject access request, or DSAR), the clock starts the day the request arrives:
- You have one calendar month to respond, with the ability to extend by two more months if the request is complex or there are many of them.
- You can ask for reasonable verification of identity, but not for more information than you need.
- You cannot charge a fee for most requests, though you can charge a reasonable fee for repeat or clearly excessive requests.
- The response must include what data you hold, why, who you share it with, and a copy of the data itself.
Most DSARs fail because businesses do not have a searchable map of where customer data lives. If your customer data sits in a store platform, an email tool, a support inbox, and three spreadsheets, a DSAR means hunting through all of them. Fix the map once and every future request gets easy.
Breach Reporting to the ICO
If you suffer a personal data breach, UK-GDPR has hard deadlines:
- Notify the ICO within 72 hours of becoming aware, where the breach is likely to result in a risk to people’s rights and freedoms.
- Notify affected individuals without undue delay when the breach is likely to result in a high risk to them.
- Document every breach, even ones you do not report, in an internal breach register.
The 72 hours run from awareness, not from your investigation concluding. If you do not have all the facts yet, report what you know and update the ICO as the picture firms up. Fines for failing to report can be separate from fines for the underlying breach, so the notification itself is not optional.
A Small Business Checklist for UK-GDPR
- Know which regime covers you: UK, EU, or both.
- Document your lawful bases for each main processing activity.
- Refresh your privacy notice with UK specifics and layer it properly.
- Map where UK customer data goes, including transfers outside the UK.
- Confirm your tools rely on UK adequacy, the Data Bridge, or the IDTA.
- Set up a DSAR process that can respond within one month.
- Write a breach plan that can notify the ICO within 72 hours.
Work through that list and you are in better shape than most UK-facing businesses, which is exactly the point: data protection is a small set of habits, not a legal department.
Compare UK-GDPR with the other laws that may apply to you
UK-GDPR is one of several privacy regimes that can cover the same business. The Global Privacy Law Hub compares GDPR, CCPA, PIPEDA, LGPD, Australia, and UK-GDPR side by side.
About The Author
