Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

UK GDPR

Amended United Kingdom · In force May 25, 2018 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectFeb 5 · 9 months ago · Source
DUAA amendments to UK GDPR commenceMain Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.
Takes effectJan 1, 2021 · 5.8 years ago · Source
UK GDPR takes effect after Brexit transitionRetained EU GDPR becomes the UK GDPR at the end of the Brexit implementation period.
Takes effectMay 25, 2018 · 8.4 years ago · Source
Data Protection Act 2018 and GDPR applyDPA 2018 and EU GDPR began applying in the UK.

Summaries for reference, not legal advice. Check the official text.

What it does

The UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.

Who it applies to
Controllers and processors established in the UK, and non-UK organisations offering goods/services to, or monitoring, individuals in the UK. No revenue or volume threshold.
Penalties
Up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher (lower tier GBP 8.7 million or 2%). Since 5 Feb 2026, PECR fines are aligned to the same UK GDPR levels.
Enforced by
Information Commissioner's Office (becoming the Information Commission on 30 Sept 2026)
Official name
UK General Data Protection Regulation and Data Protection Act 2018
Citation
Data Protection Act 2018 c. 12; UK GDPR (retained Regulation (EU) 2016/679)
Topics
Privacy, Breach notification
Verified 2026-09-22 legislation.gov.uk ico.org.uk
Research notes

See uk-duaa for the full staged commencement of the 2025 amendments. UK adequacy decision from the EU was renewed in 2025 (not separately verified here).

Related

In forceUnited Kingdom
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025
In forceSwitzerland
Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023
AmendedTurkey
Turkey KVKKTurkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).In effect since Apr 7, 2016
ProposedUnited Kingdom
UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date set
AmendedUnited Kingdom
UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018
EnactedUnited Kingdom
UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set
In forceUnited Kingdom
UK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025
In forceUnited Kingdom
UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024
Questions about UK GDPR
What are the UK GDPR compliance deadlines?
May 25, 2018: Data Protection Act 2018 and GDPR apply. Jan 1, 2021: UK GDPR takes effect after Brexit transition. Feb 5, 2026: DUAA amendments to UK GDPR commence.
When does UK GDPR take effect?
UK GDPR took effect on May 25, 2018.
Who does UK GDPR apply to?
Controllers and processors established in the UK, and non-UK organisations offering goods/services to, or monitoring, individuals in the UK. No revenue or volume threshold.
What are the penalties under UK GDPR?
Up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher (lower tier GBP 8.7 million or 2%). Since 5 Feb 2026, PECR fines are aligned to the same UK GDPR levels.