United Kingdom Data Privacy Laws: UK GDPR & DPA 2018 Guide (2026)

The United Kingdom has one of the most developed data privacy frameworks in the world. Built on the foundation of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), UK law provides strong protections for individuals while imposing significant compliance obligations on organisations that process personal data.

Since Brexit, the UK has operated its own independent data protection regime, separate from the EU GDPR. The framework retains the core principles of the EU regulation but has begun diverging through the Data Use and Access Act 2025, which introduces targeted reforms to how businesses and public bodies handle personal information.

This guide covers everything you need to know about UK data privacy laws in 2026, including the legal framework, enforcement powers, your rights as a data subject, international data transfers, and the most recent legislative changes.

The UK Data Protection Framework: How It Works

The UK data protection framework rests on two primary pieces of legislation that work together. The UK GDPR sets out the core rules and principles for processing personal data, while the Data Protection Act 2018 supplements it with additional provisions specific to the UK context.

UK GDPR (Retained EU Law)

When the UK left the European Union on 31 January 2020, the EU GDPR was incorporated into domestic law through the European Union (Withdrawal) Act 2018. This retained version, known as the UK GDPR, maintains the same structure, principles, and obligations as the EU regulation but operates as a standalone piece of UK legislation.

The UK GDPR applies to any organisation that processes the personal data of individuals in the UK, regardless of where that organisation is based. This extraterritorial reach means that a company in the United States, Japan, or any other country must comply with UK GDPR if it offers goods or services to UK residents or monitors their behaviour.

Data Protection Act 2018

The Data Protection Act 2018 received Royal Assent on 23 May 2018 and provides the detailed implementation framework for the UK GDPR. It includes provisions that the UK GDPR leaves to member states to define, such as exemptions and additional conditions for processing sensitive data.

The DPA 2018 also contains separate frameworks for law enforcement processing (Part 3) and intelligence services processing (Part 4), which operate outside the UK GDPR but maintain their own data protection standards.

The Seven Data Protection Principles

The UK GDPR establishes seven fundamental principles that underpin all data processing activities. These principles are not optional guidelines. They are legally binding requirements, and violating them can result in the highest tier of fines.

The seven principles require that personal data must be:

1. Processed lawfully, fairly and transparently in relation to the data subject
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed
4. Accurate and kept up to date, with every reasonable step taken to ensure inaccurate data is corrected or erased without delay
5. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing
6. Processed with appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage
7. Subject to accountability, meaning the controller must be responsible for and able to demonstrate compliance with all other principles

Infringements of these basic principles are subject to the highest tier of administrative fines, up to GBP 17.5 million or 4% of total worldwide annual turnover, whichever is higher.

Lawful Bases for Processing Personal Data

Before processing any personal data, organisations must identify and document a lawful basis under Article 6 of the UK GDPR. There are six available lawful bases.

The Six Lawful Bases

Lawful Basis	Description	Common Use Cases
Consent	The individual has given clear, specific consent for processing	Marketing emails, cookies, research participation
Contract	Processing is necessary to fulfil or enter into a contract	Employment records, customer order processing
Legal Obligation	Processing is necessary to comply with the law	Tax reporting, anti-money laundering checks
Vital Interests	Processing is necessary to protect someone's life	Emergency medical treatment, disaster response
Public Task	Processing is necessary for an official function or task in the public interest	Government services, regulatory functions
Legitimate Interests	Processing is necessary for your or a third party's legitimate interests, balanced against the individual's rights	Fraud prevention, network security, direct marketing

Organisations must determine their lawful basis before processing begins. They cannot change the lawful basis retroactively, and they must communicate it to data subjects through a privacy notice.

Special Category Data

Certain types of sensitive personal data receive additional protection under Article 9 of the UK GDPR. Special category data includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation.

To process special category data lawfully, an organisation must identify both a lawful basis under Article 6 and a separate condition under Article 9. The DPA 2018 Schedule 1 sets out 23 additional substantial public interest conditions that may apply.

Data Subject Rights Under UK GDPR

The UK GDPR grants individuals a comprehensive set of eight rights regarding their personal data. These rights empower people to control how their information is used.

Right to Be Informed

Organisations must provide clear, transparent information about how they collect and use personal data. This information is typically delivered through privacy notices, which must be concise, written in plain language, and freely accessible.

Right of Access (Subject Access Requests)

Individuals can request a copy of all personal data an organisation holds about them. Organisations must respond within one calendar month, free of charge in most cases. This right allows people to verify the lawfulness of processing and understand what information is held about them.

Right to Rectification

If personal data is inaccurate or incomplete, individuals can request that it be corrected. Organisations must respond within one calendar month.

Right to Erasure (Right to Be Forgotten)

In certain circumstances, individuals can request the deletion of their personal data. This right applies when the data is no longer necessary for its original purpose, when consent is withdrawn, when the individual objects to processing, or when the data has been processed unlawfully.

Right to Restrict Processing

Individuals can request that an organisation limits how it uses their data in certain situations. The data can still be stored, but not actively used.

Right to Data Portability

When processing is based on consent or contract and carried out by automated means, individuals can request their personal data in a structured, commonly used, machine-readable format. They can also request that the data be transmitted directly to another organisation where technically feasible.

Right to Object

Individuals can object to the processing of their personal data when it is based on public task or legitimate interests. They have an absolute right to object to processing for direct marketing purposes.

Rights Related to Automated Decision-Making

Individuals have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on them. They can request human intervention, express their point of view, and contest the decision.

The Information Commissioner's Office (ICO)

The Information Commissioner's Office is the UK's independent supervisory authority for data protection and information rights. Sponsored by the Department for Science, Innovation and Technology, the ICO is led by the Information Commissioner, currently John Edwards, who was appointed in January 2022.

ICO Powers and Responsibilities

The ICO has broad enforcement powers under the DPA 2018, including the ability to:

• Issue information notices requiring organisations to provide specific information
• Issue assessment notices allowing the ICO to carry out data protection audits
• Issue enforcement notices requiring organisations to take or stop taking specified actions
• Issue penalty notices (fines) for breaches of data protection law
• Prosecute criminal offences under the DPA 2018
• Conduct consensual and compulsory audits of organisations

The ICO also provides guidance, codes of practice, and educational resources to help organisations comply with data protection law. It handles complaints from individuals who believe their data protection rights have been violated.

Penalties and Fines Under UK GDPR

The UK GDPR establishes a two-tier penalty structure that gives the ICO significant enforcement power.

Penalty Structure

Tier	Maximum Fine	Applies To
Higher tier	GBP 17.5 million or 4% of total annual worldwide turnover (whichever is higher)	Infringements of data protection principles, lawful bases for processing, data subject rights, and international transfer rules
Standard tier	GBP 8.7 million or 2% of total annual worldwide turnover (whichever is higher)	Infringements of obligations on controllers and processors, certification bodies, and monitoring bodies

The ICO also has the power to issue fines for failure to comply with information notices, assessment notices, or enforcement notices. Failing to notify a breach when required can result in a fine of up to GBP 8.7 million or 2% of global turnover.

Notable ICO Enforcement Actions

The ICO has taken enforcement action against several high-profile organisations, demonstrating its willingness to use its penalty powers.

British Airways (2020): The ICO fined British Airways GBP 20 million for a data breach affecting more than 400,000 customers. The breach, which occurred in 2018, involved attackers harvesting personal data and payment card details from the BA website and mobile app. The ICO found that BA had failed to implement appropriate security measures under Article 5(1)(f) and Article 32 of the UK GDPR.

Marriott International (2020): Marriott received a GBP 18.4 million fine after a cyber-attack on Starwood Hotels (acquired by Marriott in 2016) compromised approximately 339 million guest records worldwide. The attack originated in 2014 and went undetected until September 2018.

Clearview AI (2022): The ICO fined US-based Clearview AI GBP 7.5 million and issued an enforcement notice for scraping images of UK residents from the web and social media to build a facial recognition database. The Upper Tribunal upheld the fine in October 2025, though Clearview was granted permission to appeal to the Court of Appeal.

TikTok (2023): The ICO issued a GBP 12.7 million penalty against TikTok for misusing children's personal data. The ICO found that TikTok processed the data of children under 13 without appropriate parental consent, violating Articles 5(1)(a), 8, 12, and 13 of the UK GDPR. TikTok has appealed the fine, with the hearing scheduled for May 2026.

Data Breach Notification Requirements

The UK GDPR imposes strict requirements for reporting personal data breaches. Understanding these rules is essential for any organisation that handles personal data in the UK.

When to Notify the ICO

Under Article 33 of the UK GDPR, organisations must report a personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. This obligation applies when the breach is likely to result in a risk to the rights and freedoms of individuals.

Not every breach requires notification. Organisations must assess the likely risk and only report breaches that meet the threshold. If you take longer than 72 hours to report, you must provide reasons for the delay.

When to Notify Affected Individuals

If a breach is likely to result in a high risk to the rights and freedoms of individuals, the organisation must also notify the affected individuals directly and without undue delay. The threshold for notifying individuals is higher than for notifying the ICO.

What to Include in a Breach Report

Breach reports to the ICO must include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects.

The UK GDPR allows phased reporting under Article 33(4), recognising that it may not be possible to investigate a breach fully within 72 hours. Organisations can provide information in stages as long as they do so without undue delay.

International Data Transfers

Transferring personal data outside the UK requires compliance with specific rules under the UK GDPR. These rules ensure that data transferred internationally continues to receive adequate protection.

Adequacy Decisions

The UK Secretary of State can make adequacy regulations recognising that a third country or international organisation provides an adequate level of data protection. When an adequacy decision is in place, data can flow freely to that country without additional safeguards.

As of 2026, the UK has recognised several countries as providing adequate data protection, including all EU/EEA member states, and has established the UK Extension to the EU-US Data Privacy Framework.

EU Adequacy Decision for the UK

The European Commission originally granted the UK an adequacy decision in June 2021, allowing personal data to flow freely from the EU/EEA to the UK. In December 2025, the Commission renewed both adequacy decisions (under the EU GDPR and the Law Enforcement Directive) and extended them until 27 December 2031.

This renewal was significant because the original decisions were set to expire in June 2025, with a six-month extension granted to allow the Commission to assess the impact of the Data Use and Access Act 2025 on UK data protection standards.

UK International Data Transfer Agreement (IDTA)

When transferring data to countries without an adequacy decision, organisations can use the UK International Data Transfer Agreement, which replaced the EU Standard Contractual Clauses on 21 March 2022.

The IDTA is a UK-specific contractual framework that provides legal protection for international data transfers. Organisations can use either the standalone IDTA or the UK Addendum to the EU Standard Contractual Clauses as a transfer mechanism under Article 46 of the UK GDPR.

The ICO has indicated plans to update the IDTA and Addendum in 2026 to reflect changes introduced by the Data Use and Access Act 2025.

The Data Use and Access Act 2025: Key Reforms

The Data Use and Access Act 2025 (DUAA) received Royal Assent on 19 June 2025 and represents the most significant reform to UK data protection law since the DPA 2018. The Act introduces targeted changes to the UK GDPR, DPA 2018, and the Privacy and Electronic Communications Regulations 2003.

The changes are being commenced in stages between June 2025 and June 2026, with the majority of data protection provisions coming into force on 5 February 2026.

Recognised Legitimate Interests

One of the most notable changes is the introduction of a new recognised legitimate interest lawful basis. This gives organisations greater confidence to process personal data for certain pre-approved purposes without conducting a full legitimate interests assessment.

The recognised legitimate interests include processing that is necessary for:

• Crime prevention and detection
• Safeguarding vulnerable individuals, including children
• Responding to emergencies that threaten life, health, or safety
• Safeguarding national security
• Assisting other bodies in delivering public interest tasks sanctioned by law

Automated Decision-Making Changes

The DUAA creates a more permissive framework for organisations to make decisions based solely on automated processing. Under the reformed rules, organisations can make automated decisions in wider circumstances, but they must implement specific safeguards including:

• Providing data subjects with information about significant decisions
• Enabling individuals to make representations and challenge decisions
• Ensuring human intervention is available upon request

Scientific Research Provisions

The Act clarifies that scientific research may include commercial research and allows researchers to seek consent for broad areas of related research rather than a single specific project. It also outlines the safeguards required for using personal data in research contexts.

Simplified International Transfers

The DUAA introduces a new data protection test for the Secretary of State when deciding whether to approve transfers to a third country. The new standard asks whether the third country provides a level of data protection that is not materially lower than the UK standard, replacing the previous 'essentially equivalent' test.

Children's Data Protection

New rules require certain online services likely to be accessed by children to consider how to protect and support them when designing these services. The ICO has also launched investigations into how social media and video-sharing platforms use UK children's personal information.

ICO Governance Reforms

The DUAA replaces the ICO's current governance model (a Corporation Sole led by the Information Commissioner) with a body corporate called the Information Commission. The new body will be led by a chair, chief executive, and other non-executive and executive members with shared decision-making responsibilities. This change is expected to take effect once Board members are appointed.

Data Protection Officers and DPIAs

When a DPO Is Required

Under the UK GDPR, certain organisations must appoint a Data Protection Officer (DPO). Appointment is mandatory if:

• The organisation is a public authority or public body (except courts acting in their judicial capacity)
• Its core activities require regular and systematic monitoring of individuals on a large scale
• Its core activities involve processing special category data or data relating to criminal convictions on a large scale

Organisations that do not fall into these categories may still appoint a DPO voluntarily. However, if they choose to do so, the same requirements apply as if the appointment were mandatory.

Data Protection Impact Assessments (DPIAs)

A Data Protection Impact Assessment is required before any processing that is likely to result in a high risk to individuals' rights and freedoms. This includes processing involving innovative technology, large-scale profiling, systematic monitoring of public areas, and large-scale processing of special category data.

If a DPIA identifies a high risk that cannot be mitigated, the organisation must consult the ICO before proceeding with the processing.

How UK Data Privacy Law Compares Internationally

The UK's data protection framework is widely regarded as one of the most comprehensive in the world. It shares its foundation with the EU GDPR, which means organisations that comply with one regime are generally well-positioned to comply with the other.

Key similarities with the EU GDPR include the same core principles, the same set of data subject rights, the same penalty framework (though denominated in GBP rather than EUR), and the same 72-hour breach notification requirement.

Areas of divergence are growing as the DUAA takes effect. The UK's recognised legitimate interests basis, simplified adequacy test for international transfers, and more permissive automated decision-making rules represent a deliberate shift toward a more business-friendly approach while maintaining high data protection standards.

For a broader look at how countries around the world approach data privacy, see our World Data Privacy Laws hub, which covers legislation in over 80 countries.

Practical Compliance Steps for Organisations

Organisations processing UK personal data should take the following steps to ensure compliance:

1. Map your data processing activities and maintain a Record of Processing Activities (ROPA) as required under Article 30 of the UK GDPR
2. Identify and document your lawful basis for each processing activity before it begins
3. Publish a clear privacy notice that explains what data you collect, why, and how individuals can exercise their rights
4. Implement appropriate security measures proportionate to the risk, including encryption, access controls, and regular testing
5. Establish a data breach response plan that enables notification to the ICO within 72 hours
6. Conduct DPIAs for high-risk processing activities, especially those involving new technology or large-scale data use
7. Appoint a DPO if required, or designate a responsible person for data protection compliance
8. Review international transfer mechanisms and ensure appropriate safeguards are in place for any data sent outside the UK
9. Train staff on data protection principles and their obligations under the law
10. Monitor DUAA commencement dates and update policies to reflect changes as new provisions come into force

This article is for informational purposes only and does not constitute legal advice. Data protection law is complex and evolving. Consult a qualified attorney or data protection professional for guidance specific to your situation.