United Kingdom
Full entry AI-checked Checked 5 November 2026
| Law | Citation | Status | In force from |
|---|---|---|---|
| UK GDPR | Regulation (EU) 2016/679 as it forms part of UK law, as amended | In force | 1 January 2021 |
| Data Protection Act 2018 | 2018 c. 12 | In force | 25 May 2018 |
| Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) | SI 2003/2426 | In force | 11 December 2003 |
| Data (Use and Access) Act 2025 | 2025 c. 18 | In force | 19 June 2025 |
- UK GDPR: The UK’s retained version of the EU GDPR, read with the Data Protection Act 2018.
- Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR): Cookies and similar technologies, and electronic marketing.
- Data (Use and Access) Act 2025: Amends the three laws above, in stages. Most data protection and PECR changes took effect on 5 February 2026. From 19 June 2026, controllers must make it easy for people to complain to them about data protection infringements, for example with an online form, acknowledge each complaint within 30 days and, without undue delay, respond and report the outcome (DPA 2018 s.164A). The Information Commission replaced the ICO on 30 September 2026.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”UK GDPR covers processing in the context of a UK establishment, and processing by organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour there. Such organisations usually need a UK representative.
Sources: legislation.gov.uk/eur/2016/679/article/3 · legislation.gov.uk/eur/2016/679/article/27
Lawful bases
Section titled “Lawful bases”Seven lawful bases since 5 February 2026 (Art. 6(1)). The new one, recognised legitimate interests, covers only the purposes listed in Annex 1, such as preventing or detecting crime, safeguarding children and vulnerable adults, emergencies and national security, and needs no balancing test. Direct marketing, intra-group sharing for internal admin and network security are named only as examples of ordinary legitimate interests, which still need one. Public authorities can’t use either legitimate interests basis for their tasks.
Sources: legislation.gov.uk/eur/2016/679/article/6 · legislation.gov.uk/eur/2016/679/annex/1
Consent age for online services
Section titled “Consent age for online services”When an online service offered directly to a child relies on consent, children can consent for themselves from 13. Below that, a parent must give or authorise consent.
Sources: legislation.gov.uk/ukpga/2018/12/section/9 · legislation.gov.uk/eur/2016/679/article/8
Children
Section titled “Children”The Age Appropriate Design Code applies to online services likely to be used by under-18s, with high-privacy defaults and minimal data. Since 5 February 2026, such services must also take children’s higher protection needs into account in data protection by design (Art. 25).
Sources: ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens… · legislation.gov.uk/ukpga/2025/18/section/81
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a device needs consent after clear and comprehensive information, and consent can be given through browser or other software settings. No consent is needed to carry a communication or for what’s strictly necessary for a service the user asked for. Since 5 February 2026 it’s also not needed for analytics used only to improve the service, adapting a site’s appearance or functions, or locating a user whose device calls for emergency help. For analytics and appearance, people must get clear information and a free, simple way to object.
Sources: legislation.gov.uk/uksi/2003/2426/regulation/6 · legislation.gov.uk/uksi/2003/2426/schedule/A1
Electronic marketing
Section titled “Electronic marketing”Marketing emails and texts to individuals need prior consent, unless the soft opt-in applies (details collected in a sale or negotiation, similar products only, and an opt-out at collection and in every message). Since 5 February 2026 charities have their own soft opt-in for supporters.
Sources: legislation.gov.uk/uksi/2003/2426/regulation/22
Breach notification
Section titled “Breach notification”Report a personal data breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it’s unlikely to risk people’s rights. Tell the people affected without undue delay when the risk to them is high.
Sources: legislation.gov.uk/eur/2016/679/article/33 · legislation.gov.uk/eur/2016/679/article/34
Registration and fees
Section titled “Registration and fees”Controllers pay an annual data protection fee unless exempt. Tier 1 (micro) £52, Tier 2 (small and medium) £78, Tier 3 (large) £3,763, with £5 off for paying by direct debit.
Sources: legislation.gov.uk/uksi/2018/480/regulation/3 · ico.org.uk/for-organisations/data-protection-fee
Data protection officer
Section titled “Data protection officer”Appoint a data protection officer if you’re a public authority, or if your core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal offence data.
Sources: legislation.gov.uk/eur/2016/679/article/37
International transfers
Section titled “International transfers”Transfers outside the UK need UK adequacy regulations, appropriate safeguards such as the International Data Transfer Agreement or the Addendum to the EU’s standard contractual clauses, or a listed exception. A transfer risk assessment is now called a “data protection test”.
Sources: legislation.gov.uk/eur/2016/679/article/44 · ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/internati…
Impact assessments
Section titled “Impact assessments”Carry out a data protection impact assessment before processing that’s likely to be high risk to people, such as large-scale special category data or systematic monitoring. Consult the regulator first if a high risk remains after mitigation.
Sources: legislation.gov.uk/eur/2016/679/article/35 · legislation.gov.uk/eur/2016/679/article/36
Automated decisions and AI
Section titled “Automated decisions and AI”Since 5 February 2026, significant decisions based solely on automated processing are allowed with safeguards. People must be told about them and be able to make representations, get human intervention and contest the decision. If special category data is used, the decision must be based entirely on data the person explicitly consented to, or be needed for a contract or required or authorised by law with a substantial public interest condition met (Art. 22B). No solely automated significant decision can rely on recognised legitimate interests.
Sources: legislation.gov.uk/eur/2016/679/article/22A · legislation.gov.uk/eur/2016/679/article/22B · legislation.gov.uk/eur/2016/679/article/22C
Penalties
Section titled “Penalties”Fines up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious UK GDPR infringements, and up to £8.7 million or 2% for others. Since 5 February 2026, PECR breaches are fined under the same powers, up to £17.5 million or 4% for rules including security, cookies, traffic and location data, and marketing, and up to £8.7 million or 2% for other PECR rules.
Sources: legislation.gov.uk/ukpga/2018/12/section/157 · legislation.gov.uk/uksi/2003/2426/schedule/1 · ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statemen…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/uk.yaml.