The EU’s General Data Protection Regulation stopped applying directly in the UK on January 1, 2021. Since then, the country has operated under its own version, the UK GDPR, which copies the EU text almost word for word but exists as a separate law enforced by UK authorities. So when people ask does GDPR apply in the UK, the accurate answer is that a GDPR applies, just not the EU one: UK residents’ data is governed by the UK GDPR, sitting alongside the Data Protection Act 2018. The EU GDPR can still reach a UK organization, but only when that organization is targeting people in the EU.
Why the UK Has Its Own GDPR Now
When the UK left the EU, the European Union (Withdrawal) Act 2018 pulled the text of the EU GDPR into domestic law. That retained version is what is now called the UK GDPR. The Data Protection Act 2018 works next to it, handling UK-specific matters and the areas the original EU regulation left to member states, such as processing by law enforcement and intelligence services.
The result is two parallel regimes with the same structure, the same principles, and nearly identical wording, but different legal footing. The EU GDPR governs the European Economic Area. The UK GDPR governs the United Kingdom. Which one applies to a given activity depends on whose data is being processed and where the people are, not where the company is based.
When the EU GDPR Still Applies to a UK Business
The EU GDPR has extraterritorial reach. A UK-based company that offers goods or services to people in the EU, or that monitors the behavior of EU residents, remains subject to the EU GDPR despite Brexit. In that situation the business has to comply with both laws: the UK GDPR for its UK-facing activities and the EU GDPR for anything aimed at EU data subjects. It may also need to appoint a representative inside the EU as a local point of contact.
The mirror rule holds for organizations outside the UK. A company based in the United States, the EU, or anywhere else falls under UK GDPR jurisdiction if it offers products or services to people in the UK or tracks their online behavior within the UK.1Legislation.gov.uk. Regulation (EU) 2016/679 – Article 3 If it has no UK establishment, it must designate a UK-based representative for contact with the Information Commissioner’s Office and with data subjects.2Legislation.gov.uk. Regulation (EU) 2016/679 – Article 27
How the Two Regimes Differ in Practice
On the substance, the UK GDPR is close enough to the EU GDPR that a business already compliant with one is largely compliant with the other. The differences that matter tend to be procedural: who regulates, how much fines are denominated in, how data moves across the border, and how each regime handles transfers onward to third countries.
Different Regulator
Complaints, audits, and enforcement in the UK go through the Information Commissioner’s Office, not any EU authority. The ICO enforces both the UK GDPR and the Data Protection Act 2018 and publishes the guidance UK organizations are expected to work from. It also administers a UK-specific annual data protection fee that most UK organizations processing personal data have to pay, on top of any obligations they carry under the EU regime.3ICO. Guide to the Data Protection Fee
Fines in Sterling
The UK GDPR keeps the EU’s two-tier fine structure but expresses the caps in pounds. The standard tier reaches up to £8.7 million or 2% of global annual turnover, whichever is higher, and covers procedural failures. The higher tier reaches up to £17.5 million or 4% of global annual turnover, whichever is higher, and covers breaches of the core principles, lawful basis rules, consent requirements, data subject rights, and international transfer restrictions.4ICO. Penalties A company that runs afoul of both regimes can be fined separately by each regulator.
Data Flowing Between the UK and the EU
Under the UK GDPR, sending personal data out of the UK is a “restricted transfer” that needs a legal basis, typically a UK adequacy regulation, appropriate safeguards such as the International Data Transfer Agreement or the Addendum to the EU’s standard contractual clauses, or a narrow derogation.5ICO. A Brief Guide to International Transfers
UK to EEA is generally straightforward because the UK government treats EEA countries as adequate. The harder direction has always been EU to UK. In June 2021 the European Commission granted the UK adequacy status under both the EU GDPR and the Law Enforcement Directive, so EU organizations can send personal data to the UK without extra safeguards. That decision was originally due to expire on June 27, 2025, and the EU has since renewed it.6ICO. Receiving Personal Information From the EEA The renewal is conditional in the sense that if UK law drifts too far from EU standards, the assessment can be revisited.
Transfers to the United States
For UK-to-US transfers, the UK Extension to the EU-U.S. Data Privacy Framework offers a streamlined route. A US company self-certifies to the EU-U.S. Data Privacy Framework through the Department of Commerce and then opts into the UK Extension; once listed, it can receive UK personal data without an IDTA or other contractual safeguard.7Data Privacy Framework. Data Privacy Framework (DPF) Program Overview
Where the US recipient hasn’t self-certified, the transfer usually requires the IDTA or the Addendum, plus a Transfer Risk Assessment confirming that protection won’t drop after the data leaves the UK.8ICO. What Are Standard Data Protection Clauses (the UK IDTA and the Addendum)? These are UK instruments; the EU has its own equivalents, which is why cross-border transfers can require paperwork under both regimes for the same data flow.
Where UK Law Is Starting to Diverge
The UK GDPR is no longer a straight copy. The Data (Use and Access) Act 2025 became law in June 2025, with most of its data protection provisions commencing on February 5, 2026 and a new complaints-procedure requirement following on June 19, 2026.9ICO. Statement on the Commencement of the Data (Use and Access) Act (DUAA) The ICO has described the reforms as relatively modest.
The changes include new rules on when processing for a new purpose counts as compatible with the original purpose, a codified rule that organizations only need to make “reasonable and proportionate” searches in response to subject access requests, and broader room for automated decision-making outside the special category context. The ICO also gained new powers, including the ability to compel witnesses to attend interviews, request technical reports, and impose fines of up to £17.5 million or 4% of global turnover for breaches of the Privacy and Electronic Communications Regulations.9ICO. Statement on the Commencement of the Data (Use and Access) Act (DUAA)
These are the UK’s first real steps away from the EU GDPR template. The further UK law moves, the more work dual compliance becomes for organizations serving both markets, and the more pressure the divergence puts on the EU’s next look at UK adequacy.
What This Means If You Operate in Both Markets
If your business only handles data about people in the UK, the UK GDPR is the law that applies to you, enforced by the ICO. If you only handle data about people in the EU, the EU GDPR applies. If you handle both, you comply with both, and you may need a representative in each jurisdiction where you don’t have an establishment. The two regimes are close but no longer identical, and the gap is widening rather than closing, so treating “GDPR compliance” as a single project rather than two is a mistake that gets more expensive over time.