Regulations › United Kingdom
UK GDPR
UK GDPR and Data Protection Act 2018
WhenIn effect since 1 January 2021
Who enforces itInformation Commissioner's Office
Who it applies toOrganizations established in the UK, and those outside it offering goods or services to or monitoring people in the UK.
Tell the regulatorNotify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unl…
DPO requiredDPO required for public authorities, large-scale systematic monitoring, or large-scale special…
RegistrationMost controllers must pay an annual data protection fee to the ICO unless exempt
Transfers abroadTransfers need UK adequacy regulations under a 'not materially lower' data protection test, or…
Request deadlineRespond within one month, extendable by two months
Maximum fineUp to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to non-UK controllers offering goods or services to, or monitoring behavior of, people in the UK.UK GDPR Art. 3(2) · source ↗
Not re-verified against the source this session.
Lawful basis
1
Six GDPR bases plus a new 'recognised legitimate interests' basis (Annex 1) needing no balancing test, in force 5 Feb 2026.UK GDPR Art. 6(1)(ea), Annex 1 · source ↗
Annex 1 confirmed on legislation.gov.uk; commencement date from RPC (SI 2026/82). Art. 6(1)(ea) numbering not separately verified.
Consent
2
Consent must be freely given, specific, informed and unambiguous; DUAA permits consent to broad areas of scientific research.UK GDPR Art. 4(11), Art. 7 · source ↗
Not re-verified against the source this session.
Sensitive data
2
Special categories prohibited unless explicit consent or listed condition applies; many conditions need an appropriate policy document.UK GDPR Art. 9; DPA 2018 s.10, Sch. 1 · source ↗
Not re-verified against the source this session.
Children
1
Age of consent for information society services is 13; online services likely accessed by children must consider children's higher protection in design.DPA 2018 s.9; UK GDPR Art. 8; Art. 25 as amended by DUAA · source ↗
ICO Age Appropriate Design Code applies to under-18s. DUAA children's design duty in force 5 Feb 2026 per RPC.
People's rights
Rights
3
Access, rectification, erasure, restriction, portability, objection, and safeguards on significant automated decisions, plus a right to complain to the controller.UK GDPR Arts. 15-21, 22A-22D · source ↗
Arts. 22A-22D confirmed on legislation.gov.uk. Controller complaint procedures (DUAA s.103) commenced 19 June 2026 per RPC.
Request deadline
2
Respond within one month, extendable by two months; clock can pause while awaiting clarification; reasonable and proportionate searches suffice.UK GDPR Art. 12(3), Art. 12A · source ↗
Art. 12A text not displayed on the page read; stop-the-clock detail from GOV.UK and RPC summaries.
Marketing
2
Prior consent needed for electronic marketing, with soft opt-in for existing customers (extended to charities by DUAA); absolute right to object.PECR 2003 reg. 22; UK GDPR Art. 21(2)-(3) · source ↗
PECR and DUAA charity soft opt-in section not fetched; commencement of the charity extension not confirmed.
Governance
DPO required
1
DPO required for public authorities, large-scale systematic monitoring, or large-scale special-category or criminal data processing.UK GDPR Art. 37(1) · source ↗
Not re-verified against the source this session.
DPO qualifications
1
DPO designated on professional qualities and expert knowledge of data protection law and practice.UK GDPR Art. 37(5) · source ↗
Not re-verified against the source this session.
Registration
2
Most controllers must pay an annual data protection fee to the ICO unless exempt.Data Protection (Charges and Information) Regulations 2018 (SI 2018/480) reg. 2 · source ↗
Regulation not fetched this session; tiered fee, not licensing.
DPIA
2
DPIA required before processing likely to result in high risk; consult the ICO if high risk remains.UK GDPR Art. 35, Art. 36 · source ↗
Not re-verified against the source this session.
Records
2
Records of processing required; limited exemption for organizations under 250 employees doing occasional, low-risk processing.UK GDPR Art. 30 · source ↗
Not re-verified against the source this session.
Retention
1
Storage limitation: keep identifiable data no longer than necessary.UK GDPR Art. 5(1)(e) · source ↗
Not re-verified against the source this session.
Breaches
Tell the regulator
2
Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.UK GDPR Art. 33(1) · source ↗
Not re-verified against the source this session.
Tell people
2
Notify affected individuals without undue delay when the breach is likely to result in high risk.UK GDPR Art. 34(1) · source ↗
Not re-verified against the source this session.
Transfers
Transfers abroad
2
Transfers need UK adequacy regulations under a 'not materially lower' data protection test, or appropriate safeguards such as the IDTA or Addendum.UK GDPR Arts. 45A-45C, 46 · source ↗
Arts. 45A-45C confirmed on legislation.gov.uk; in force 5 Feb 2026 per RPC.
Enforcement
Maximum fine
3
Up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher; PECR fines now aligned to the same level.DPA 2018 s.157; DUAA Sch. 13 (PECR) · source ↗
s.157 not fetched; PECR alignment from RPC commencement summary.
Criminal liability
1
Listed offenses (unlawful obtaining, re-identification, altering records to prevent disclosure) punishable by fines; directors can be liable.DPA 2018 ss.170, 171, 173, 198 · source ↗
Not re-verified against the source this session. Fines only; no imprisonment.
Private action
2
Individuals can claim compensation for material or non-material damage; representative actions are limited in practice.UK GDPR Art. 82; DPA 2018 s.168 · source ↗
Not re-verified against the source this session.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws