UK GDPR After the Data (Use and Access) Act: What Changed and What Applies

The UK GDPR began life as a copy of the EU GDPR, kept in UK law after Brexit and read together with the Data Protection Act 2018. For several years the two were almost identical. That is no longer quite true. The Data (Use and Access) Act 2025 amended UK data protection law, and its main data protection changes took effect in 2026: recognised legitimate interests that need no balancing test, more room for automated decision-making with safeguards, clarified subject access searches, a duty to handle complaints, new cookie exemptions, and a reworked test for international transfers.

For IT and SaaS companies, the practical result is that most of a GDPR programme still works in the UK, but the details now differ. This guide explains who the UK regime applies to, the core duties, the 2025 reforms, transfers to and from the UK, cookies and marketing under PECR, ICO fees and fines, and what software teams should change.

What is the UK GDPR?

UK data protection law consists of three main pieces:

• The UK GDPR: the EU GDPR as retained in UK law at the end of the Brexit transition period, adapted to the UK and since amended.
• The Data Protection Act 2018 (DPA 2018): supplements the UK GDPR with exemptions, conditions for special category and criminal offence data, the ICO's powers, and separate regimes for law enforcement and intelligence services processing.
• The Privacy and Electronic Communications Regulations 2003 (PECR): rules on cookies and similar technologies, and electronic marketing.

The Data (Use and Access) Act 2025 (DUAA) amended all three. It also contains provisions on smart data schemes and digital verification services that are outside the scope of this guide.

History and why it exists

The EU GDPR applied in the UK from May 2018. When the UK left the EU, the European Union (Withdrawal) Act 2018 kept the GDPR as domestic law from 1 January 2021, creating the UK GDPR. In June 2021 the European Commission adopted adequacy decisions allowing personal data to flow from the EU to the UK. The UK government then pursued reforms intended to reduce burdens while maintaining high standards; after an earlier bill lapsed in 2024, the Data (Use and Access) Act received Royal Assent in June 2025. Its data protection provisions were brought into force by commencement regulations, with the majority in force from February 2026 and further provisions later in 2026.

The aim is to keep strong protection for individuals while giving organisations clearer bases for common processing, and to keep EU adequacy, which depends on UK law remaining essentially equivalent.

Who must comply?

The UK GDPR applies to processing in the context of a UK establishment, and to controllers and processors outside the UK that offer goods or services to people in the UK or monitor their behaviour there. Non-UK controllers caught by that test must usually appoint a UK representative. For IT companies:

• A SaaS company selling to UK customers is a controller for its own customer data and a processor for customer content.
• An Indian or EU IT services firm processing UK personal data for a UK client is a processor and must accept UK GDPR processor terms.
• Companies subject to both the EU and UK regimes must comply with each and may need representatives in both.

Most UK organisations that process personal data must also pay the ICO an annual data protection fee under separate regulations, unless exempt.

Core requirements (shared with the EU GDPR)

• The seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
• A lawful basis for every processing purpose, with additional conditions for special category data.
• Transparency through privacy notices.
• Individual rights: access, rectification, erasure, restriction, portability, objection, and rights related to automated decisions.
• Data protection by design and by default, records of processing, DPIAs for high-risk processing, and data protection officers where required.
• Processor contracts with prescribed terms.
• Appropriate security, and notification of personal data breaches to the ICO within 72 hours where feasible, and to individuals when the risk is high.
• Rules for transfers outside the UK.

If you already run a GDPR programme, these map directly; see our GDPR guide for detail.

What the Data (Use and Access) Act 2025 changed

Recognised legitimate interests

A new lawful basis allows processing for a defined list of recognised legitimate interests without the usual balancing test, such as certain purposes related to national security and defence, emergencies, crime prevention and detection, and safeguarding vulnerable people. The Act also confirms that purposes such as direct marketing, intra-group transfers for administrative purposes and ensuring network and information system security can be legitimate interests, though these still need the balancing test.

Automated decision-making

The former Article 22 was replaced with new provisions (Articles 22A to 22D). Significant decisions based solely on automated processing are generally permitted on any lawful basis provided safeguards are in place: information about the decision, the ability to make representations, to obtain human intervention and to contest it. Stricter limits remain for decisions involving special category data. This matters for software that scores, ranks or approves people.

Subject access requests

The Act confirms that controllers need only make reasonable and proportionate searches, and clarifies when the response time starts and when it can be paused while waiting for information needed to identify the person or clarify the request.

Complaints

Controllers must facilitate complaints from data subjects, for example by providing an electronic complaint form, acknowledge them within a set period and respond without undue delay. The ICO may expect complainants to have used this route first.

Cookies and electronic marketing

PECR now allows certain cookies without consent, such as those used for some analytics, website functionality and appearance, provided users are given clear information and a simple way to object. PECR penalties were raised to align with UK GDPR maximums.

Research, scientific purposes and further processing

Clarified definitions of scientific research, including commercial research, and clearer rules on compatible further processing.

International transfers

A new "data protection test" applies when the Secretary of State approves transfers to other countries and when organisations use appropriate safeguards: protection must not be materially lower than in the UK.

The regulator

The ICO is being restructured into a corporate body, the Information Commission, with a board. Check the ICO's website for the current status.

International transfers to and from the UK

• From the UK: transfers are allowed to countries covered by UK adequacy regulations (which include EU and EEA countries and others), under the UK Extension to the EU-U.S. Data Privacy Framework (often called the UK-US data bridge) for certified US organisations, or with appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment.
• From the EU to the UK: allowed under the European Commission's adequacy decisions for the UK, which were reviewed in light of the reforms. Check the Commission's adequacy page for current status.
• To India: there is no UK adequacy regulation for India at our last review, so transfers usually rely on the IDTA or UK Addendum with a risk assessment.

How to comply, step by step

1. Confirm applicability and your role for each data set; appoint a UK representative if required.
2. Pay the ICO data protection fee if you are a UK controller and not exempt.
3. Map personal data and assign lawful bases, considering whether a recognised legitimate interest applies.
4. Update privacy notices for the reforms, including automated decision-making information and complaint routes.
5. Build or update rights handling: subject access with proportionate searches and documented timelines, deletion, correction and objection.
6. Add a complaints process with an electronic form and acknowledgement.
7. Review automated decisions in your product and implement the required safeguards.
8. Review cookies against the new PECR exemptions, keeping consent where still required.
9. Put transfer mechanisms in place for data leaving the UK.
10. Maintain security and a 72-hour breach process.

Documentation required

• Records of processing activities.
• Privacy notices and cookie information.
• Legitimate interest assessments where the balancing test applies, and records of recognised legitimate interest reliance.
• DPIAs for high-risk processing.
• Processor contracts and sub-processor lists.
• Transfer documentation: IDTA or UK Addendum and transfer risk assessments.
• Subject access and complaint logs.
• Breach register and notifications.
• Security policies and evidence.

Enforcement and certification

The ICO enforces the UK GDPR, DPA 2018 and PECR through information notices, assessment notices, enforcement notices, reprimands and monetary penalties. There is no general UK GDPR certification; ICO-approved certification schemes and codes of conduct can support accountability. Customers often accept ISO/IEC 27001, ISO/IEC 27701 and Cyber Essentials as supporting evidence.

Timeline and cost considerations

The UK GDPR has applied since 2021 and the reforms took effect through 2026, so organisations should already have updated notices, complaint handling and automated decision safeguards. Costs include legal review, engineering for rights and complaints, cookie tooling, transfer documentation, the ICO fee and staff training. Organisations with mature EU GDPR programmes can usually adapt rather than rebuild.

Benefits and consequences of non-compliance

Compliance allows you to serve UK customers, satisfies procurement requirements, and builds trust. The reforms can reduce friction for routine processing, such as low-risk analytics cookies and security monitoring.

Fines under the UK GDPR reach up to 17.5 million pounds or 4 percent of total worldwide annual turnover, whichever is higher, for the most serious infringements, and up to 8.7 million pounds or 2 percent for others. PECR penalties now align with these levels. The ICO can also order processing to stop and require changes, and individuals can claim compensation.

Common mistakes and challenges for IT companies

• Assuming EU and UK rules are identical after 2026.
• No UK representative for non-UK controllers targeting UK users.
• Relying on EU standard contractual clauses alone for UK transfers without the UK Addendum or IDTA.
• Over-reading the cookie exemptions: advertising and cross-site tracking still need consent.
• Automated decisions without safeguards such as human review and a way to contest.
• No complaint route that meets the new duty.

Best practices, tools and technologies

• Maintain a single privacy programme with jurisdiction-specific settings for the EU and UK.
• Use a consent management platform configured for UK PECR exemptions and EU ePrivacy rules separately.
• Build human review and appeal into automated decisions.
• Provide self-service data access and deletion, and an online complaint form.
• Keep a transfer register showing the mechanism for each data flow.

We build rights handling, complaint forms and cookie controls into web applications and online stores for UK audiences.

How the UK GDPR relates to other laws and frameworks

Law or framework	Relationship
EU GDPR	Same origin; now diverging in specific areas after the DUAA.
ePrivacy Directive	EU cookie rules; the UK equivalent is PECR, now with different exemptions.
EU-U.S. DPF and UK Extension	Mechanism for transfers to certified US organisations.
Cyber Essentials	UK security certification often used as evidence of appropriate technical measures.
ISO/IEC 27701	Privacy management system that can cover both UK and EU obligations.

Real-world enforcement examples

The ICO publishes its enforcement actions. Notable examples include fines against companies for unlawful electronic marketing under PECR, and monetary penalties for security failures leading to breaches, such as the penalty against British Airways in 2020 (reduced to 20 million pounds) following a 2018 attack that diverted customers to a fraudulent site and exposed payment card data. The ICO has also increasingly used reprimands, particularly in the public sector.

An illustrative case for an EU SaaS company with UK customers: its EU GDPR programme covers most needs. It appoints a UK representative, adds the UK Addendum to transfers to its Indian development centre, updates its cookie banner to treat UK and EU visitors differently, adds an online complaint form, and documents safeguards for its automated lead-scoring feature.

Next steps

1. Check applicability and appoint a UK representative if needed.
2. Update notices, complaints handling and automated decision safeguards for the DUAA.
3. Review cookies against PECR as amended.
4. Fix transfer documentation for data leaving the UK.
5. Pay the ICO fee and keep records current.

Frequently asked questions

Is the UK GDPR the same as the EU GDPR?

It started as the same text, but the Data (Use and Access) Act 2025 introduced differences, including recognised legitimate interests, automated decision-making rules, complaint handling and cookie exemptions.

Does the UK GDPR apply to companies outside the UK?

Yes, if they offer goods or services to people in the UK or monitor their behaviour there, and processors for UK clients are bound by contract.

What is the Data (Use and Access) Act 2025?

A UK law that amended the UK GDPR, the Data Protection Act 2018 and PECR, among other things. Its main data protection changes took effect during 2026.

Do we need to register with the ICO?

Most UK controllers must pay an annual data protection fee to the ICO unless an exemption applies.

What are the UK GDPR fines?

Up to 17.5 million pounds or 4 percent of worldwide annual turnover for the most serious infringements, and up to 8.7 million pounds or 2 percent for others.

Can we use EU standard contractual clauses for UK transfers?

Only with the UK Addendum. Alternatively, use the UK International Data Transfer Agreement.

Do we still need cookie consent in the UK?

For most advertising and tracking cookies, yes. Certain low-risk cookies, such as some analytics and functionality cookies, are now exempt if users are informed and can object.

Are automated decisions allowed under UK GDPR?

Generally yes, with safeguards such as information, the ability to make representations, human intervention and contesting the decision. Stricter rules apply to special category data.

How fast must breaches be reported in the UK?

To the ICO within 72 hours of becoming aware, where feasible, and to individuals without undue delay when the risk to them is high.

Do we need a complaints process?

Yes. Controllers must facilitate complaints, for example with an electronic form, acknowledge them and respond without undue delay.

Can personal data flow from the EU to the UK?

Yes, under the European Commission's adequacy decisions for the UK. Check the Commission's page for the current status following the reforms.