When the UK left the EU, it kept GDPR by copying it into UK data protection law. The headline is reassuring: most requirements stayed the same, so businesses that complied before Brexit didn’t have to start again. The differences still matter, though, and they’ve grown since the Data (Use and Access) Act 2025. If you have UK and EU customers, EU staff or operations on both sides, here’s what changed and what to do about it.

Contents

1. How UK GDPR Came About
2. What Stayed the Same
3. What Changed
4. International Data Transfers Post-Brexit
5. If Your Business Operates in Both the UK and EU
6. UK GDPR Reform Agenda in 2026

How UK GDPR Came About

Here’s UK GDPR explained from the start, because the timeline shapes the rules you follow today:

• 25 May 2018: GDPR starts applying across the EU, including the UK. The Data Protection Act 2018 comes into force on the same day, filling in the areas GDPR left to national law.
• 31 January 2020: The UK leaves the EU. A transition period keeps EU GDPR in place.
• 1 January 2021: The transition period ends. The European Union (Withdrawal) Act 2018 turns EU GDPR into domestic law, with amendments so it works in a UK-only context. That version becomes UK GDPR.
• 28 June 2021: The European Commission adopts adequacy decisions for the UK, so data keeps flowing from the EU.
• 19 June 2025: The Data (Use and Access) Act 2025 receives Royal Assent. Its main data protection changes take effect on 5 February 2026.

Post-Brexit GDPR in the UK is really two texts read together. UK GDPR sets the core rules, and the Data Protection Act 2018 adds the exemptions, extra conditions and enforcement powers the ICO uses.

What Stayed the Same

The core of the law didn’t move. These areas still match closely between the two regimes:

• The six principles in Article 5, from lawfulness and fairness through to integrity and confidentiality, plus the duty to show accountability
• The original lawful bases for processing, although the UK has since added one (covered below)
• Individual rights, including access, rectification, erasure, restriction, portability and objection
• Accountability duties, such as records of processing, DPIAs, and data protection by design
• DPO requirements, with the same three triggers set out in Article 37
• Breach reporting, with 72 hours to tell the regulator and no undue delay in telling people at high risk

If you built a GDPR programme before 2021, much of it still works in the UK today.

What Changed

The GDPR Brexit changes, and the differences UK GDPR has built up since, fall into four areas:

• The regulator: The ICO now oversees UK processing on its own. EU supervisory authorities have no say over UK-only processing, and the ICO has no say inside the EU.
• International transfers: The UK makes its own adequacy decisions and uses its own transfer tools, such as the International Data Transfer Agreement.
• The one-stop shop: The EU’s lead authority system no longer covers the UK. EU firms that target UK customers without a UK base need a UK representative under Article 27 of UK GDPR.
• Reform: The Data (Use and Access) Act 2025 has started a gap between the two texts that will keep widening.

Some of the differences look small on paper but change real decisions:

The UK age comes from Article 8, which matters to any online service that relies on children’s consent. In any EU GDPR UK comparison, transfers create the most ongoing work, so they get their own section next.

International Data Transfers Post-Brexit

For GDPR after Brexit, UK businesses need to keep an eye on three main data routes:

• UK to EU: The UK recognises the EEA as adequate, so personal data can flow from the UK into the EU without extra paperwork.
• EU to UK: The European Commission renewed its UK adequacy decisions in December 2025. They now run until 27 December 2031, with a mid-point review after four years.
• UK to US: Organisations certified under the UK Extension to the EU-US Data Privacy Framework can receive UK data directly. That route opened on 12 October 2023. For any other US recipient, you need the IDTA or the UK Addendum to the EU’s standard contractual clauses, plus a transfer risk assessment under the rules in Chapter V.

EU adequacy isn’t permanent. The Commission monitors UK law and can suspend or amend its decisions if UK protection drifts too far, and the 2025 reforms will feature in its next review. If adequacy fell away, every EU business sending you personal data would need standard contractual clauses and a transfer assessment, adding cost and delay to routine data flows.

If Your Business Operates in Both the UK and EU

Dual compliance doesn’t mean running two programmes. You keep one set of policies and manage two regulatory relationships:

• One policy set: You can run one set of policies built on GDPR. UK differences then go into short annexes covering lawful bases, cookies, automated decisions, and transfers.
• EU representative: If you have no EU establishment but offer goods or services to people in the EU, or monitor their behaviour there, Article 27 of EU GDPR requires you to appoint a representative in the EU. The exception is processing that’s occasional and low risk.
• Complaints: UK residents complain to the ICO, and EU residents complain to the authority in their own country. Without an EU establishment, you could face more than one EU authority over the same issue. Since June 2026, UK law has also required you to handle complaints directly and acknowledge each one within 30 days.
• Breach reporting: A single breach can mean reports to the ICO and to one or more EU authorities, each within 72 hours.

UK GDPR Reform Agenda in 2026

The Data (Use and Access) Act’s main data protection changes took effect on 5 February 2026. Some loosen the rules, and others tighten them.

What’s relaxed:

• Recognised legitimate interests: This seventh lawful basis covers listed purposes, such as preventing crime, safeguarding vulnerable people and responding to emergencies, without the usual balancing test.
• Automated decisions: Articles 22A to 22D allow more solely automated decisions, provided safeguards are in place. The limits stay tighter where special category data is involved.
• Cookies: Some low-risk cookies, such as basic analytics and those that remember a user’s preferences, no longer need consent.
• Subject access: Searches now only need to be reasonable and proportionate.
• Transfers: The new “not materially lower” test replaces the stricter equivalence standard.

What’s stricter:

• Marketing fines: Fines under PECR, the UK’s electronic marketing and cookie rules, can now reach £17.5 million or 4% of worldwide turnover, matching UK GDPR.
• Complaints: Since 19 June 2026, you must give people a way to complain to you directly.
• Children: Online services likely to be used by children must factor in children’s higher protection needs when designing their data protection measures.
• The regulator: The ICO is moving to a new structure as the Information Commissioner.

Each relaxation is optional. You can keep your existing EU-standard approach, which is the simpler route if you serve both markets.

UK GDPR vs EU GDPR isn’t a choice between two programmes. You need one programme with UK and EU annexes, kept up to date as both sides change. For a full UK GDPR guide, our GDPR hub covers lawful bases, rights and transfers in depth.

If you need a presence in the EU, our GDPR EU representative service covers it. Need dual UK-EU compliance support? Talk to KEWDATA.