GDPR

UK GDPR is the UK’s main data protection law. The UK kept its own version of the EU General Data Protection Regulation after Brexit, and it works alongside the Data Protection Act 2018. Together, they set the rules for how organisations collect, use, store and share personal data about people in the UK. The ICO enforces both.

The UK and EU texts started out almost identical, but they’re drifting apart. The Data (Use and Access) Act 2025 changed several UK rules, and most of those changes have applied since 5 February 2026. They cover lawful bases, automated decisions, subject access requests and international transfers. Some UK businesses still need to follow EU GDPR as well, so the differences matter.

This GDPR guide works through the core GDPR requirements one by one, with the 2026 changes built in. When you need hands-on help, our GDPR advisory team at KEWDATA can step in.

People have eight core rights over their personal data:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights related to automated decision-making
• Complaints: Since 19 June 2026, you must give people a way to complain to you directly, acknowledge each complaint within 30 days and respond without undue delay.
• Automated decisions: The rules on solely automated decisions now live in Articles 22A to 22D. They allow more automated decisions, as long as people can get information, contest the decision, and ask for human review. If AI makes or shapes decisions about people, our AI and LLM data protection work covers those safeguards.

The controller decides why and how personal data is processed. The processor handles it on the controller’s behalf and follows its instructions. Payroll providers, cloud hosts and email marketing platforms are common examples of processors.

Controllers carry the main responsibility for compliance. They must only use processors that give sufficient guarantees, and they need a written contract containing the terms Article 28 requires. When two organisations decide the purposes together, they become joint controllers and must agree who handles which duties.

Processors have direct duties of their own: keeping data secure, keeping records, and telling the controller about breaches without undue delay. If a processor acts outside its instructions, it becomes a controller for that processing. Knowing who holds which data, and in which role, comes first, and our data discovery work builds that map for you.

Article 37 makes a DPO mandatory in three situations:

• You’re a public authority or public body.
• Your core activities involve regular and systematic monitoring of individuals on a large scale.
• Your core activities involve large-scale processing of special category data or criminal offence data.

Your DPO must report to the highest level of management, act independently and have expert knowledge of data protection law. They can hold other duties, but not ones that create a conflict of interest, such as a senior role that decides how personal data is used. If you appoint a DPO voluntarily, the same requirements apply.

The DPO advises and monitors, while your organisation stays responsible for compliance. Our DPO as a service gives you an independent DPO during UK business hours, with monthly reporting and an annual review.

When a personal data breach happens, you have 72 hours from becoming aware of it to report it to the ICO, unless it’s unlikely to put people at risk. Article 33 lets you send details in stages if you don’t have the full picture yet, but the first report must arrive on time.

If the breach is likely to result in a high risk to people, Article 34 requires you to tell them without undue delay. You also need to explain what happened and how they can protect themselves. Every breach must be recorded, including the ones you decide not to report, along with your reasoning.

Processors must alert their controller without undue delay. The faster you detect a breach, the more of the 72-hour window you keep, which is where our data auditing and monitoring service helps.

Sending personal data outside the UK counts as a restricted transfer. You can make one in three ways:

• To a country covered by UK adequacy regulations
• Using an appropriate safeguard
• Under a limited exception
• The International Data Transfer Agreement
• The UK Addendum to the EU’s standard contractual clauses
• Binding corporate rules

The 2026 reforms changed the transfer test in Chapter V. Before relying on a safeguard, you now check that protection in the destination country isn’t materially lower than in the UK. Data flowing the other way, from the EU to the UK, still moves freely: the European Commission renewed its UK adequacy decisions in December 2025, and they run until December 2031.

UK GDPR expects you to show compliance, not just claim it. Good data protection, GDPR or otherwise, comes down to evidence: documented policies, records of processing, trained staff, and impact assessments for processing likely to result in high risk.

Security must match the risk you’re handling. The law names data encryption and pseudonymisation as examples of suitable measures, alongside strict access controls and regular testing.

Fines for the most serious breaches reach £17.5 million or 4% of worldwide annual turnover, whichever is higher. Recent ICO GDPR enforcement shows the regulator looks closely at the safeguards you had in place before something went wrong.

• Financial Sector
• Healthcare Industry
• E-Commerce & Retail
• Cloud & IT Infrastructure

For GDPR compliance, UK organisations rarely need to start from scratch. Our GDPR compliance assessment measures your current data protection measures against UK GDPR, and against EU GDPR where it applies. You receive:

• A compliance report that sets out each gap and where it sits
• A risk assessment ranked by potential harm to people and to your business
• A roadmap that puts the most urgent fixes first