The UK GDPR, next to the EU one.
The UK kept the GDPR after Brexit, with changes from the Data (Use and Access) Act 2025. Serve the UK in Privacyboard: your policy names the UK regulator, your UK representative, and the same deadlines apply.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- UK companies, and others serving or tracking people in the UK
- Maximum fine
- GBP 17.5 million or 4% of worldwide turnover
- Deadlines
- 1 month per request, 72 hours per breach
- Regulator
- The Information Commission, formerly the ICO
What the UK GDPR asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
The same notice as the EU GDPR, naming the UK regulator.
In Privacyboard
Your policy adds the UK regulator when you serve the UK.
Every plan
Show all 5 duties as a list
Art. 13–14Tell people in the UKEvery plan
What the law asks: The same notice as the EU GDPR, naming the UK regulator.
In Privacyboard: Your policy adds the UK regulator when you serve the UK.
Art. 12, 15Answer within a monthEvery plan
What the law asks: One month, extendable by two; the clock stops while you ask for clarification.
In Privacyboard: The same deadlines and templates as for the EU. Request form on Pro.
Art. 27Name a UK representativeEvery plan
What the law asks: Required for most companies outside the UK that serve people there.
In Privacyboard: Your UK representative shown in your policy and center.
Art. 33Report breaches in 72 hoursEvery plan
What the law asks: Notify the Information Commission when people are at risk.
In Privacyboard: The breach register counts down 72 hours.
PECRCookiesEvery plan
What the law asks: Consent, with new exemptions for analytics if people can object.
In Privacyboard: Visitors in the UK are asked for consent, the cautious choice.
The numbers to know
or 4% of turnover, the top fine, now also for cookies
to report a breach to the regulator
to acknowledge a complaint, since June 2026
Most organisations also pay a yearly data protection fee to the regulator.
What changed recently
DUAA passed
Changes start in stages.
Most changes apply
Cookie exemptions, higher PECR fines.
Complaints
Acknowledge within 30 days.
Information Commission
Replaces the ICO.
What Privacyboard covers, and what it does not
Covered
- The UK regulator in your policy
- Your UK representative published
- One-month deadlines and templates
- 72-hour breach countdown
- Consent for visitors in the UK
Not covered
- Paying the data protection fee
- Using the new analytics cookie exemption: the banner still asks
- Acting as your UK representative
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Add the UK
In Company profile, Activity.
- 2
Add your UK representative
If you are outside the UK.
- 3
Validate your policy
It names the UK regulator.
- 4
Publish your center
UK requests use the same form.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Is UK GDPR the same as the EU GDPR?
Very close. The DUAA 2025 added changes, such as recognised legitimate interests and cookie exemptions.
Who is the UK regulator now?
The Information Commission, which replaced the ICO on 30 September 2026.
Do we need a UK representative?
If you are outside the UK and serve people there, usually yes, unless your processing is occasional and low risk.
Are analytics cookies exempt now?
Only with clear information and a free, simple way to object. Privacyboard keeps asking for consent.
Official sources
- UK GDPR, legislation.gov.uk
- Data Protection Act 2018, section 157 (fines)
- GOV.UK, the Information Commission succeeds the ICO
- GOV.UK, DUAA commencement plans
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
