GDPR vs UK GDPR: what differs, what does not, and how to run one programme for both

GDPR vs UK GDPR: the short answer

When the United Kingdom left the European Union, it did not write a new data protection law from a blank page. It kept the GDPR in domestic law under a new name, the UK GDPR, and placed it beside an amended Data Protection Act 2018. The Information Commissioner's Office summarises the result plainly: the key principles, rights and obligations remain the same.

So the substance an auditor, a customer or a data subject cares about starts out largely identical. The differences sit in who enforces the law, which statute amends it, how data leaves each jurisdiction and what each side has changed or proposed to change since. The practical question is whether one programme answers to both, and where it needs a UK or EU layer.

What does not differ

Both regimes rest on accountability: the organisation that decides why and how data is used must be able to show compliance, not merely assert it. Both use the controller and processor roles and expect the same working evidence.

• A record of processing that reflects the systems people actually use, with purposes, categories, recipients and retention.
• A lawful basis decided and reasoned for each activity, with consent records wherever consent is the basis relied on.
• Privacy notices written for each audience and a working procedure for access, erasure and the other individual rights.
• Contracts with processors, a current list of sub-processors and security measures matched to risk.
• Impact assessments for high-risk processing and a breach register, including breaches you decided not to report.

Evidence built for one regime largely serves the other. The detail of each obligation is covered in GDPR requirements explained, article by article and the evidence set in GDPR documentation: records, notices, contracts and DPIAs.

What differs, side by side

Where a UK detail depends on provisions still being brought into force, the table says so rather than guessing.

The Data (Use and Access) Act 2025

The Act received Royal Assent on 19 June 2025. Part 5 deals with data protection and privacy: its first chapter amends the UK GDPR and the Data Protection Act 2018, and its second amends the rules on privacy and electronic communications. Part 6 establishes the Information Commission and abolishes the office of the Information Commissioner.

Commencement is phased. Some provisions took effect on Royal Assent, others two months later, and the remainder start on dates the Secretary of State sets by regulations. The ICO has said its guidance is under review because of the Act. Two consequences follow.

• Do not treat the UK GDPR as a frozen copy of the EU text. Each UK procedure should name the provision it relies on and be checked when a commencement order is made.
• Do not assume a UK relaxation applies in Europe. A change that simplifies a UK obligation leaves the EU obligation where it was, so a group policy written to the lighter standard can fall short on one side.

Which individual UK changes are in force on a given date is a question for the legislation and the ICO's current guidance; have your legal advisers confirm it before a policy is rewritten.

Which law applies to your organisation?

Businesses with customers or staff on both sides of the Channel usually answer to both. The EU Regulation reaches organisations established in the Union and, under Article 3(2), those outside it that offer goods or services to people in the Union, whether or not payment is involved, or that monitor their behaviour there. A UK company with no EU office can therefore be caught by the EU GDPR, and Article 27 then requires it to designate a representative in the Union in writing, unless its processing is occasional, low-risk and free of large-scale special-category or criminal-offence data.

This is a starting point, not legal advice; confirm with counsel where the answer changes contracts or appointments.

Running one programme for both

Two parallel programmes produce two records of processing that disagree. A single programme with a jurisdiction layer is easier to run and to defend: a shared core of policies, the record, the rights procedure, the breach procedure and the impact-assessment method, with each activity tagged for the law or laws that govern it.

The layer then holds only what truly diverges: the regulator you would notify, the transfer mechanism for each flow, the fee, the representative, and any UK provision brought in by the 2025 Act or EU provision changed by a future amendment. When one side moves, you change the layer and leave the core alone; never copy one side's relaxation into a group policy. The UK market itself is covered in GDPR compliance in the United Kingdom.

GDPR vs UK GDPR: questions buyers ask