Regulations › United Kingdom
UK GDPR
UK GDPR and Data Protection Act 2018
WhenIn effect since 1 January 2021
Who enforces itInformation Commissioner's Office
Who it applies toOrganizations established in the UK, and those outside it offering goods or services to or monitoring people in the UK.
Tell the regulatorNotify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unl…
DPO requiredDPO required for public authorities, large-scale systematic monitoring, or large-scale special…
RegistrationMost controllers must pay an annual data protection fee to the ICO unless exempt
Transfers abroadTransfers need UK adequacy regulations under a 'not materially lower' data protection test, or…
Request deadlineRespond within one month, extendable by two months
Maximum fineUp to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws