A current comparison of the UK and EU versions of GDPR, including the divergence created by the Data (Use and Access) Act 2025 and what it means for UK and EU businesses.
UK and EU GDPR share their origins and many core duties, but they are separate regimes. Territorial scope, regulators and transfer arrangements already differed after Brexit, and the Data (Use and Access) Act 2025 introduced further UK-specific changes.
This guide compares the rules as at 15 October 2026. The DUAA provisions affecting data protection law and PECR are now in force, and the regulator became the Information Commission on 30 September 2026.
The short answer
UK GDPR and EU GDPR remain very similar in their fundamentals. Both have the same seven principles, the same definition of personal data, the same controller/processor framework, and most of the same individual rights. If your compliance programme is built around these, you are covering most of what each regime requires.
Differences include the UK's seventh lawful basis, significant automated decisions, PECR cookie exceptions, transfer assessments and complaints procedures. Assess the provisions relevant to each activity; compliance with one regime does not automatically establish compliance with the other.
The European Commission renewed the UK's adequacy decision on 19 December 2025, valid until 27 December 2031. That means personal data can continue to flow freely from the EU to the UK without further safeguards, and the EU has signalled — at least for now — that UK divergence is within tolerable limits.
Why the UK has its own GDPR
When the UK left the European Union, EU regulations stopped applying directly. To avoid losing the protection of GDPR overnight, the UK retained it as part of domestic law under the European Union (Withdrawal) Act 2018. The retained version became known as the UK GDPR. It came into effect on 1 January 2021, alongside the Data Protection Act 2018 — which had been passed back in 2018 to supplement the original EU GDPR.
So today, UK data protection law has three main pillars:
- UK GDPR — the core rules on processing personal data.
- Data Protection Act 2018 — UK-specific provisions, including law enforcement processing and exemptions.
- Privacy and Electronic Communications Regulations 2003 (PECR) — rules on cookies, electronic marketing, and certain telecoms-specific data protections.
The Data (Use and Access) Act 2025 amended all three. It did not replace any of them.
Where the two regimes differ today
Key substantive differences as at 15 October 2026 include:
A new UK lawful basis: recognised legitimate interests
Recognised legitimate interest is the seventh UK lawful basis. It covers specified statutory purposes and removes the balancing test, but necessity and the conditions for the relevant purpose must still be assessed and documented. It is not a general-purpose shortcut around data protection duties.
EU GDPR has no equivalent seventh basis. An EU controller must select one of its existing bases appropriate to the circumstances, such as legal obligation, public task, vital interests or legitimate interests; ordinary legitimate interests is not automatically the correct choice.
Automated decision-making
EU GDPR Article 22 restricts significant solely automated decisions, subject to its exceptions. UK Articles 22A–22D permit such decisions on an appropriate basis other than recognised legitimate interest, with safeguards. Special category decisions remain restricted under Article 22B. The safeguards include information, representations, human intervention and a way to contest the decision.
Organisations using significant automated decisions should assess the applicable UK and EU rules separately, including whether any human involvement is meaningful.
Cookie consent and PECR exemptions
From 5 February 2026, PECR added statistical-purposes, appearance and emergency-assistance exceptions to its existing communication and strictly-necessary exceptions. Each has conditions; statistics and appearance require clear information and a simple free objection route. Advertising and behavioural profiling are not exempt.
The EU's ePrivacy regime — the equivalent of PECR — still requires consent for most non-essential cookies. The proposed ePrivacy Regulation, which would have aligned the EU framework with GDPR, was formally withdrawn by the European Commission in 2025.
International data transfers
For transfers of personal data outside the UK, the DUAA replaced the EU-derived "essential equivalence" test with a UK-specific "not materially lower" test. Controllers and processors relying on safeguards like the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, now assess whether the destination country's protection is "not materially lower" than UK standards.
For a UK transfer relying on relevant safeguards, the controller or processor must act reasonably and proportionately in deciding whether protection after transfer is not materially lower than in the UK. Do not treat the wording as automatic approval of a destination or a removal of the assessment.
PECR penalties
From 5 February 2026, the higher PECR maximum is £17.5 million or 4% of an undertaking’s worldwide annual turnover, whichever is higher. The fixed sterling cap is 35 times the former £500,000 amount. The applicable maximum in an individual case depends on the conduct and transitional rules.
EU electronic-communications requirements and penalties depend on national implementation alongside EU data protection law. Check the relevant member state's rules rather than assuming a single EU PECR-equivalent cap.
The regulator
The ICO formally transitioned to the Information Commission on 30 September 2026, overseen by a collective board. Its public-facing name is the Information Commission's Office, or ICO. The governance change does not remove its core regulatory responsibilities.
Scientific research
The DUAA clarified research concepts, introduced provisions for qualifying broad consent and amended transparency and safeguard rules. EU GDPR also has research provisions. Neither regime grants a blanket exemption from lawful basis, transparency or safeguards merely because an activity is described as research.
Children's online services
The amended UK law requires online services likely to be accessed by children to consider specified children's higher-protection matters in design. This sits alongside the Children's Code; it should not be treated as simply converting every part of that code into an identical statutory rule.
Practical implications for UK businesses
The core principles and rights continue to apply. Subject access responses are normally due within one calendar month, with defined adjustments and extensions. Reportable breaches must be notified without undue delay and, where feasible, within 72 hours of awareness.
The two practical changes most UK organisations should plan for:
- A complaints procedure. Since 19 June 2026, controllers must facilitate data protection complaints, acknowledge them within 30 days and respond without undue delay, taking appropriate steps to investigate and inform the complainant.
- PECR penalty exposure. If your cookie banner is non-compliant, or your marketing list management is loose, the maximum fine is now the same as a serious data breach. The ICO has said it is actively monitoring the top 1,000 UK websites for cookie compliance.
Practical implications for businesses with EU customers
Where UK and EU territorial rules both cover an activity, comply with both. Analyse each regime's scope and requirements; merely choosing whichever rule seems stricter may overlook distinct duties, such as representatives and transfer mechanisms.
You may also need to appoint an EU representative under Article 27 of the EU GDPR if you don't have an establishment in an EU member state. The same requirement runs in the opposite direction: EU-only organisations targeting UK customers need a UK representative.
The EU's December 2025 adequacy renewal supports covered transfers from the EEA to the UK. UK adequacy regulations support covered transfers in the other direction. Other UK GDPR obligations, including security and processor contracts, still apply.
Keeping the comparison current
The principal DUAA data protection and PECR provisions are in force. Keep the following under review:
- The complaints arrangements introduced on 19 June 2026 and how they work alongside subject access and other rights requests.
- Current ICO guidance for automated decisions, recognised legitimate interest, transfers and the relevant processing activity.
- Information Commission guidance and regulatory decisions following the 30 September 2026 governance transition.
The adequacy decisions are subject to ongoing European Commission monitoring and can be amended, suspended or repealed under the applicable rules. Their scheduled review or expiry does not guarantee that no earlier change is possible.
For deeper context, our hub guide to UK GDPR covers the basics, our seven principles guide covers what's shared between the two regimes, and our cookie consent guide covers the PECR-specific changes in detail.
Frequently asked questions
Are UK GDPR and EU GDPR the same?
They are very similar in fundamentals but not identical. The DUAA has introduced UK-specific reforms in 2025–2026, including a new lawful basis, changes to automated decision-making, and cookie consent flexibilities.
Do I need to comply with both?
Assess Article 3 in each regime. Processing in the context of an establishment may be covered, as may offering goods or services to people in the relevant territory or monitoring their behaviour there. Citizenship or residence alone is not the territorial test.
Will the UK lose EU adequacy?
The European Commission renewed UK adequacy in December 2025. It remains subject to the decisions' conditions and ongoing monitoring, so no organisation should treat its future status as guaranteed.
What's the biggest difference between UK GDPR and EU GDPR?
One material difference is significant solely automated decision-making. The UK permits qualifying decisions on an appropriate basis other than recognised legitimate interest, with safeguards and special-category restrictions. EU Article 22 retains its different exception-based framework.
How does the DUAA change UK GDPR?
By adding new flexibility in several areas — a seventh lawful basis, automated decision-making, cookies, scientific research — and introducing some new obligations, particularly the direct right to complain to controllers from June 2026. It amends UK GDPR rather than replacing it.
Related guides
- GDPR cookie consent in the UK: rules after the DUAA 2025
- GDPR fines and penalties in the UK: how big, who pays, what counts
- GDPR data breach: what to do in the first 72 hours
Make sure your team understands UK data protection law and how it applies to their everyday work.
Explore the GDPR & Data Protection Course →Sources & references
- ICO: DUAA changes, updated June 2026
- ICO: international-transfer data protection test
- European Commission: UK adequacy decisions
- ICO: Information Commission transition,30 September 2026
- EU GDPR
- UK GDPR, as amended
- ICO: EEA-to-UK adequacy decisions
Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.