UK GDPR after Brexit: what differs from the EU GDPR

By the Privacyboard teamPublished 9 November 2026Updated 12 November 202610 min read

Short answer

The UK GDPR started as a copy of the EU GDPR, and its core principles, rights and duties are still the same. Since the Data (Use and Access) Act 2025 came into force, mostly on 5 February 2026, the UK differs on some cookies that no longer need consent, "recognised" legitimate interests, automated decisions, access request searches, a complaints procedure, transfer rules and PECR fines.

The UK GDPR is the UK's own version of the GDPR. It kept the EU text when the UK left the EU, so the principles, the lawful bases, people's rights, the 72-hour breach rule and the record of processing are still the same. The two laws have drifted apart since the Data (Use and Access) Act 2025 (DUAA), whose data protection changes mostly came into force on 5 February 2026, with a new complaints duty from 19 June 2026.

If you serve people in both the UK and the EU, you now have two sets of rules to follow. This guide lists where they differ, as of 9 November 2026, with a table and a checklist. It is general information, not legal advice.

When the Brexit transition period ended, the GDPR was kept in UK law as the UK GDPR, read together with the Data Protection Act 2018. The ICO, the UK regulator, says the key principles, rights and obligations stayed the same, while the rules on transfers between the UK and the EEA changed.

Since 30 September 2026, the ICO has been replaced by the Information Commission, which took over its role as the UK regulator. The guidance quoted below was published by the ICO.

The UK GDPR has the same reach as the EU text, pointed at the UK:

it applies to organisations established in the UK;
it applies to organisations outside the UK that offer goods or services to people in the UK, or monitor their behaviour there.

The reverse is also true. The ICO reminds UK businesses that "the EU GDPR still applies" to their processing when they have an establishment in the EEA, sell to people there, or monitor them. A UK online shop with French customers can be under both laws at once.

Cookies and email marketing in the UK sit in a separate law, the Privacy and Electronic Communications Regulations (PECR), as the ePrivacy rules do in the EU.

#What changed with the Data (Use and Access) Act 2025?

The DUAA amends the UK GDPR, the Data Protection Act 2018 and PECR. The ICO says the changes were phased in between June 2025 and June 2026. Its statement of February 2026 confirmed that most of the remaining data protection provisions came into force on 5 February 2026, and that the duty to have a complaints procedure followed on 19 June 2026.

The EU GDPR has not been amended in the same way. At the date of this article, the EU's own "Digital Omnibus" changes to the GDPR are still being negotiated and have not been adopted, so the EU text in force is unchanged.

#Where do the UK and EU rules differ now?

Topic	EU GDPR and ePrivacy	UK GDPR and PECR, as of 9 November 2026
Cookies for analytics	Consent needed, apart from narrow national exceptions	No consent needed for statistics used only to improve your own service, if you inform people and let them object for free
Cookies that remember settings	Consent unless strictly necessary	No consent needed for appearance or functionality, with information and a free way to object
Advertising cookies	Consent	Consent. The ICO says advertising "never" was exempt
Legitimate interests	Three-part test, including balancing, every time	Same test, plus "recognised legitimate interests" (crime, safeguarding, emergencies, security, disclosures to public bodies) with no balancing test
Solely automated decisions	Only with contract, law or explicit consent	Allowed on other bases with safeguards (inform, let people object, human review), except for special category data
Access requests	Search for all the data	"Reasonable and proportionate" searches; the clock can stop while you ask for clarification
Complaints	Through the regulator	You must offer a way to complain, acknowledge within 30 days and reply without undue delay
Transfers out	Adequacy, SCCs, BCRs; "essentially equivalent" protection	UK adequacy regulations, IDTA or UK Addendum; protection "not materially lower"
Age for consent to online services	16 by default; countries may lower it to 13	13
Maximum fines	€20 million or 4% of worldwide turnover	£17.5 million or 4% (higher maximum), £8.7 million or 2% (standard)
PECR or ePrivacy fines	Set by each country	Up to £17.5 million or 4% of turnover
Registration fee	None at EU level	Data protection fee to the UK regulator, from £52 to £3,763 a year unless exempt
Representative for non-established firms	EU representative (Article 27)	UK representative (UK Article 27)

#What changed for cookies in the UK?

The DUAA added new exceptions to the PECR consent rule. According to the ICO's guidance on storage and access technologies, you do not need consent when the only purpose is:

statistics: counting how your service is used so you can improve it. You must give clear information, offer a "simple and free" way to object, not track or profile individual visitors, and not use the data for advertising;
appearance or functionality: remembering a visitor's settings or adapting the service to them, under the same conditions, and without tailoring content to inferred interests;
emergency assistance: locating someone who asked for emergency help.

The older exceptions remain: transmitting a communication, and what is strictly necessary for the service the user asked for, which now explicitly includes security and fraud prevention.

Two points are easy to miss. First, the analytics exception still requires an opt-out, so a UK banner or cookie page needs a working "object" option for analytics. Second, advertising, ad measurement and fingerprinting for ads still need consent in the UK.

In the EU, analytics cookies generally still need consent. A single banner for both audiences has to handle that difference by visitor location or apply the stricter rule everywhere.

#What are "recognised legitimate interests"?

The DUAA adds a new lawful basis listed in an annex to the UK GDPR. For a short list of purposes you still need to show the processing is necessary, but there is no balancing test against people's interests. The ICO lists them as:

disclosures to public bodies that need the data for a public task;
national security, public security and defence;
emergencies;
detecting, investigating or preventing crime;
safeguarding vulnerable people.

The Act also names examples of ordinary legitimate interests: direct marketing, sharing within a group for administration, and network and information security. Those still need the full three-part test, as in the EU.

#How do access requests and complaints work in the UK now?

The deadline is unchanged: one month, extendable in some cases. What changed:

you only have to make reasonable and proportionate searches;
the clock starts when you have the request, any identity information you asked for, and any fee you are allowed to charge;
you can stop the clock while you wait for clarification you reasonably need.

Since 19 June 2026, UK organisations must also run a data protection complaints procedure. The ICO says you must give people a clear way to complain, such as an electronic form, acknowledge each complaint within 30 days, investigate it and tell the person the outcome without undue delay. The EU GDPR has no equivalent duty.

#How do transfers between the UK and the EU work?

Data can still move freely in both directions:

EU to UK: the European Commission renewed its two UK adequacy decisions on 19 December 2025. The ICO says both last until 27 December 2031.
UK to EEA: the UK has adequacy regulations covering each EEA country.
UK to the US: the "UK-US data bridge" has applied since 12 October 2023 to US organisations certified to the UK Extension of the EU-US Data Privacy Framework.

For other countries, UK exporters use the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment. Under the DUAA, the test is whether protection after the transfer is "not materially lower" than in the UK, applied reasonably and proportionately. The ICO says it plans to update the IDTA and the Addendum during 2026.

#Do you need a UK representative?

If you have no establishment in the UK but the UK GDPR applies to you, Article 27 of the UK GDPR requires you to name a representative in the UK. The exceptions are public bodies and processing that is occasional, does not involve special category or criminal data at scale, and is unlikely to create a risk for people.

This works like the EU representative, but it is a separate role. A US company selling to both the UK and the EU may need one of each. Privacyboard's company profile shows a representatives section only when you may need one, in the EU, the UK or Switzerland. Name your representative in your privacy policy.

#What stayed the same?

Most of the daily work is identical:

the seven principles, including data minimisation and storage limitation;
the six lawful bases, plus the new recognised legitimate interests in the UK;
the rights to be informed, of access, rectification, erasure, restriction, portability and objection;
notifying a reportable breach to the regulator within 72 hours;
the record of processing, DPIAs for high-risk processing, processor contracts and data protection officers.

So one privacy programme can cover both laws, with UK-specific adjustments.

#Checklist: serving people in the UK and the EU

Map which law applies: UK establishment, EU establishment, or customers in each.
Pay the data protection fee if you are a UK controller and not exempt.
Name a UK representative (Article 27 UK GDPR) and an EU one if you are established in neither.
Review your cookie banner: consent for ads everywhere, and for analytics in the EU; a free opt-out for exempt UK analytics.
Update your privacy policy with the UK regulator (the Information Commission, formerly the ICO), your UK representative and the UK transfer tools.
Publish a way to make a data protection complaint, acknowledge within 30 days and log the outcome.
Update your access request process for proportionate searches and stopping the clock.
Check transfers: EU adequacy for the UK until 27 December 2031, the IDTA or UK Addendum for other countries, and the UK Extension for US vendors.
Review automated decisions: inform people, let them make representations and get human review.
Keep using the 72-hour breach process for both regulators.

#FAQ

It started as the same text, and the principles, rights and main duties are still the same. Since the Data (Use and Access) Act 2025, the UK has its own rules on some cookies, recognised legitimate interests, automated decisions, access requests, complaints, transfers and fines.

Yes, for processing linked to an establishment in the EEA, or for offering goods or services to people in the EEA or monitoring them there. The ICO says the EU GDPR still applies in those cases.

Only under the statistics exception: the cookies collect statistics used only to improve your own service, you give clear information, you offer a simple and free way to object, and the data is not used to track individuals or for advertising. Visitors in the EU generally still need to consent.

#Is data still allowed to flow from the EU to the UK?

Yes. The European Commission renewed its UK adequacy decisions on 19 December 2025. According to the ICO, they last until 27 December 2031, with a review planned during that period.

The higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%. Since 5 February 2026, PECR fines for cookie and marketing breaches can also reach £17.5 million or 4%.

#Does a company outside the UK need a UK representative?

Usually yes, if the UK GDPR applies because it sells to or monitors people in the UK. Public bodies and occasional, low-risk processing that does not involve sensitive or criminal data at scale are exempt.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.