What Is UK GDPR? UK General Data Protection Regulation + Data Protection Act 2018
The UK's data protection framework has two interlocking parts: the UK GDPR (the retained-EU-law version of GDPR that has applied since 1 January 2021) and the Data Protection Act 2018 (DPA 2018), which supplements it with UK-specific provisions on immigration, national security, law enforcement processing (Part 3), and intelligence services (Part 4). In substance, UK GDPR broadly mirrors EU GDPR, but the text, regulator guidance, and UK-specific derogations control the details. The ICO is the supervisory authority, with enforcement powers up to £17.5 million or 4% of annual global turnover, whichever is higher. The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025. Most Part 5 data-protection and privacy provisions came into force on 5 February 2026, and current ICO guidance updated 19 June 2026 says all DUAA stages are in force. Organisations must provide a way to make data-protection complaints, acknowledge them within 30 days, take appropriate steps and keep the complainant informed, and provide an outcome without unjustifiable or excessive delay; this complaint route is separate from the one-month rights-request timeline. The European Commission's current adequacy page lists the UK's GDPR and law-enforcement adequacy decisions as renewed in December 2025, subject to their terms and future review.
At a glance
- Full name
- UK General Data Protection Regulation + Data Protection Act 2018
- Short code
- UK GDPR
- Jurisdiction
- United Kingdom
- Enacted
- 2018
- Last major update
- UK GDPR in force Jan 2021 post-Brexit; DUAA 2025 changes phased through 19 June 2026; EU adequacy renewed December 2025
- Regulator
- Information Commission (ICO, formerly the Information Commissioner's Office)
- Private right of action
- Yes
- Statutory citation
- Data Protection Act 2018 + UK GDPR
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR (highlighted), LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: UK GDPR statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who UK GDPR covers
Protected data
Data subject rights
Right of access (Article 15), obtain confirmation of processing and a copy of personal data
Right to rectification (Article 16), correct inaccurate or incomplete data
Right to erasure / "right to be forgotten" (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20), receive data in structured, machine-readable format
Right to object (Article 21), including to direct marketing and profiling
Rights relating to automated decision-making and profiling (Article 22)
Right to lodge a complaint with the ICO
Right to compensation for damage (Article 82)
Notable features
The UK GDPR includes UK-specific derogations, including provisions in the DPA 2018 for immigration, law-enforcement, and intelligence processing. The UK also retains its own adequacy-decision framework, separate from the EU framework; check the current ICO and government lists for the destination at issue.
Enforcement & penalties
Regulator: Information Commission (ICO, formerly the Information Commissioner's Office)
Penalties: Two-tier administrative fines: standard tier up to £8.7 million or 2% of annual worldwide turnover; higher tier up to £17.5 million or 4% of annual worldwide turnover, whichever is higher. The ICO issued Clearview AI a £7.5M penalty notice in 2022; the ICO's October 2025 Upper Tribunal update says the case was sent back to the First-tier Tribunal and that permission to appeal to the Court of Appeal was granted in December 2025, so the matter should not be described as finally resolved or overturned. Historical penalty amounts are case-specific and should be checked against the current ICO enforcement record.
Private right of action: Article 82 UK GDPR grants a right to compensation for material or non-material damage from a GDPR infringement. Under section 187 DPA 2018, an authorised representative body may exercise specified rights on a data subject’s behalf; this is not a blanket opt-out class-action right. The Supreme Court's 2021 Lloyd v Google judgment narrowed opt-out class actions, while direct individual claims remain fact-specific.
Relevance to data brokers
UK GDPR may apply to a data broker outside the UK when the Article 3 conditions are met, including offering goods or services to people in the UK or monitoring their behaviour. Article 17 provides an erasure right subject to conditions and exceptions; the controller’s legal basis and balancing analysis still matter. A broker relying on legitimate interests should be able to explain that basis and its assessment, but an individual request does not establish the outcome in advance.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is the difference between EU GDPR and UK GDPR?+
The UK GDPR is the UK-retained version of EU GDPR that has applied since 1 January 2021, following Brexit. Both use GDPR-style rights and legal bases, but the texts, amendments, regulator guidance, and court interpretation can diverge. The UK supplements UK GDPR with the Data Protection Act 2018, which adds UK-specific provisions for national security, law enforcement, and immigration.
How do I file a complaint with the ICO?+
Submit a complaint through the ICO’s current complaint route. The ICO recommends giving the organisation a chance to handle its data-protection complaint process first, but says you can complain to the ICO at any time; do not treat the organisation’s 30-day acknowledgment period as a universal precondition to contacting the ICO.
Can a data broker outside the UK be subject to UK GDPR?+
Potentially. Article 3 UK GDPR can apply to a controller or processor outside the UK when the statutory offering or monitoring conditions are met. Article 27 may also require a UK representative, subject to its conditions and exceptions; a data broker should assess that obligation rather than assuming it from a listing alone.
What is a Subject Access Request (SAR)?+
A SAR is a request under Article 15 UK GDPR asking a controller to confirm whether they process your personal data and provide a copy. Controllers must respond within one calendar month (extendable to three months for complex requests) and must provide the data free of charge in the first instance.
What changed under the Data (Use and Access) Act 2025?+
The DUAA received Royal Assent on 19 June 2025. Most Part 5 data-protection and privacy changes came into force on 5 February 2026, and ICO guidance updated 19 June 2026 says all stages are in force. Organisations must provide a way to make data-protection complaints, acknowledge them within 30 days, investigate and keep people informed, and respond without unjustifiable or excessive delay. The Act also changes areas such as cookies, recognised legitimate interests, automated decision-making, and research, so the provision-specific safeguards still matter.
Official sources & citations
Other international privacy regimes
UK GDPR sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: