Sign in

UK GDPR

UK GDPR and the Data Protection Act 2018 — UK Parliament / Information Commissioner's Office

Also known as: UK GDPR, DPA 2018, Data Protection Act 2018, UK Data Protection

Official site Official change log Subscribe to UK GDPR (RSS)

Current version
UK GDPR (as amended to 30 September 2026)
Published 30 September 2026. source
Status
In force
Next deadline
None announced
Who must comply
Controllers and processors established in the United Kingdom, and those outside it that offer goods or services to, or monitor the behaviour of, people in the United Kingdom. source
How it is assessed
Organisations apply the rules themselves and must report qualifying breaches to the regulator and handle data protection complaints. source
Authority
The Information Commission regulates the UK GDPR; on 30 September 2026 the office of Information Commissioner was abolished and its functions transferred to the Commission. source source
Enforced by
The regulator issues penalty notices of up to £17.5 million or 4% of worldwide turnover; recent fines include £14.47 million against Reddit. source
Last change

The UK data protection regime, read as two documents at once: the assimilated General Data Protection Regulation and the Data Protection Act 2018 that gives it effect and fills its national gaps. The two have diverged from their European originals, which is precisely why they need watching separately from GDPR.

Recent changes

  1. High
    Data (Use and Access) Act 2025 amends UK GDPR

    The Data (Use and Access) Act 2025 (ukpga/2025/18) has taken effect on the UK GDPR, modifying Regulation (EU) 2016/679 as it applies in the United Kingdom. …

    Amendment Effective 2026-11-06 Action required

  2. Medium
    Data (Use and Access) Act 2025 amends Data Protection Act 2018

    The Data (Use and Access) Act 2025 has amended the Data Protection Act 2018. Organizations subject to UK GDPR must review updates to data protection obligations …

    Amendment Action required

  3. Medium
    UK Data Protection Act 2018 amended by Victims and Prisoners Act 2024 affects GDPR implementation

    The Victims and Prisoners Act 2024 brings amendments that impact how the UK GDPR applies, particularly in relation to data subject rights and exemptions. Organizations processing …

    Amendment Action required

  4. High
    Victims and Prisoners Act 2024 amends the Data Protection Act 2018

    The Victims and Prisoners Act 2024 has been recorded as effecting a legislative change to the Data Protection Act 2018, with the modification registered on 30 …

    Amendment Effective 2026-10-30 Action required

  5. Medium
    Levelling-up and Regeneration Act 2023 amends Data Protection Act 2018

    The Levelling-up and Regeneration Act 2023 introduces amendments to the Data Protection Act 2018, UK legislation that implements the UK GDPR framework. These changes may affect …

    Amendment Action required

  6. Medium
    Employment Rights Act 2025 affects interpretation of Data Protection Act 2018 provisions

    The Employment Rights Act 2025 has amended provisions relevant to the Data Protection Act 2018, particularly regarding employment-related data processing. This affects how organisations must handle …

    Amendment Action required

  7. Medium
    UK GDPR amended by Data (Use and Access) Act 2025 Consequential Amendments Regulations

    The Data (Use and Access) Act 2025 Consequential Amendments and Transitional Provision Regulations 2026 have taken effect, modifying the UK General Data Protection Regulation. These amendments …

    Amendment Action required

  8. Medium
    Data Protection Act 2018 amended by Data (Use and Access) Act 2025 Consequential Amendments Regulations 2026

    The Data Protection Act 2018 has been modified by consequential amendments introduced through the Data (Use and Access) Act 2025 Regulations 2026. These amendments ensure consistency …

    Amendment Action required

  9. Medium
    Data (Use and Access) Act 2025 amends UK GDPR framework

    The Data (Use and Access) Act 2025 modifies the UK GDPR regulatory framework with effect from 21 September 2026. This legislation introduces new requirements and mechanisms …

    Amendment Action required

  10. Medium
    Data (Use and Access) Act 2025 affects Data Protection Act 2018 provisions

    The Data (Use and Access) Act 2025 modifies certain provisions of the Data Protection Act 2018. Organizations must review how these legislative changes impact their existing …

    Amendment Action required

  11. Medium
    Victims and Prisoners Act 2024 affects UK GDPR requirements on exemptions and disclosures

    The Victims and Prisoners Act 2024 has introduced amendments that affect how UK GDPR applies to requests for access to personal data in victim and prisoner …

    Amendment Action required

  12. Medium
    Victims and Prisoners Act 2024 amends Data Protection Act 2018

    The Victims and Prisoners Act 2024 brings amendments to the Data Protection Act 2018. These amendments update provisions governing the processing of personal data in contexts …

    Amendment Action required

  13. Medium
    Employment Rights Act 2025 affects Data Protection Act 2018 provisions

    The Employment Rights Act 2025 introduces changes to how the Data Protection Act 2018 applies in employment contexts. These amendments clarify worker rights under UK GDPR …

    Amendment Action required

  14. Medium
    Children's Wellbeing and Schools Act 2026 modifies UK GDPR requirements

    The Children's Wellbeing and Schools Act 2026 introduces amendments affecting the application of UK GDPR (Regulation (EU) 2016/679) in the United Kingdom. These changes modify how …

    Amendment Action required

That is the last 90 days. Sign in to read further back.

Key dates

No upcoming dates
  1. The office of Information Commissioner is abolished and its functions transfer to the Information Commission
  2. Controllers must handle data protection complaints from data subjects under new section 164A of the Data Protection Act 2018
  3. New right to erasure ground for data processed because of a malicious allegation (Article 17(1)(g))
  4. Most data protection changes in the Data (Use and Access) Act 2025 come into force
Show 2 earlier dates
  1. First Data (Use and Access) Act 2025 provisions come into force, including new statutory objectives for the regulator
  2. Data (Use and Access) Act 2025 receives Royal Assent

Amendments

  1. UK GDPR (as amended to 30 September 2026) AmendmentCurrent text

    References to the Information Commissioner were replaced with the Information Commission when the regulator's functions transferred to the new body. source

  2. UK GDPR (amended 31 March 2026) Amendment

    A new erasure ground, Article 17(1)(g), covers personal data processed because of an allegation by a person convicted of stalking or harassment of the data subject, or subject to a stalking protection order. source

  3. UK GDPR (amended 5 February 2026) Amendment

    Most data protection and privacy changes in Part 5 of the Data (Use and Access) Act 2025 took effect, simplifying parts of the UK GDPR and modernising the regulator's enforcement powers. source

    More
    • A new "recognised legitimate interests" lawful basis removes the balancing test for listed purposes such as protecting public security.
    • Significant automated decisions can rely on any lawful basis, including legitimate interests, with safeguards; special category data stays more protected.
    • Some cookies, such as those for statistics or website functionality, can be set without consent.
  4. UK GDPR (end of the implementation period) Major version

    The UK version of the GDPR, adapted by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, took effect at the end of the implementation period. source

Who it applies to

The UK GDPR covers processing by organisations established in the UK, and by organisations abroad that target or monitor people in the UK.

UK establishments
Processing in the context of the activities of a controller or processor established in the United Kingdom, wherever the processing takes place (Article 3(1)). source
Outside the UK
Controllers or processors not established in the United Kingdom that offer goods or services to people in the United Kingdom or monitor their behaviour there (Article 3(2)). source
Amending law
The Data (Use and Access) Act 2025 amends, but does not replace, the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. source

How compliance is assessed

Organisations apply the rules themselves and must report qualifying breaches to the regulator and handle data protection complaints.

Breach notification
Notify the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people (Article 33). source
Complaints
Help people make complaints, for example with an electronic form, acknowledge them within 30 days and respond without undue delay. source
Complaints start date
The complaint-handling duties apply to complaints received on or after 19 June 2026. source

Enforcement and penalties

The regulator issues penalty notices of up to £17.5 million or 4% of worldwide turnover; recent fines include £14.47 million against Reddit.

£17.5M or 4% of worldwide turnover

The higher maximum amount (section 157(5)), whichever is higher for an undertaking; it also applies to failing to comply with an information, assessment, interview or enforcement notice (section 157(4)). source

£8.7M or 2% of worldwide turnover

The standard maximum amount (section 157(6)); it also caps penalties for breaching the complaint-handling duties in section 164A (section 157(4A)). source

Penalty notices
Penalties are imposed by penalty notice under section 155 of the Data Protection Act 2018, with maximum amounts set in section 157. source

Recent fines

  1. £963,900

    South Staffordshire Plc and South Staffordshire Water Plc, for failing to keep personal data secure (Articles 5(1)(f) and 32(1)); includes a settlement reduction. source

  2. £14,472,500

    Reddit, Inc., for processing the data of children under 13 without robust age assurance and without a data protection impact assessment before January 2025 (Articles 5(1)(a), 6, 8 and 35). source

Documents

  1. Law text UK GDPR (latest revised text, legislation.gov.uk)
  2. Law text Data Protection Act 2018, section 157 (maximum amount of penalty)
  3. Law text Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
  4. Law text Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026
  5. Guidance Data Use and Access Act 2025: plans for commencement (DSIT)
Show 1 more document
  1. Guidance The Data (Use and Access) Act 2025 - what does it mean for organisations? (ICO)

Frequently asked questions

What changed in UK GDPR in 2026?

Most of the Data (Use and Access) Act 2025 data protection changes took effect on 5 February 2026, a new erasure ground on 31 March 2026, complaint-handling duties on 19 June 2026, and the Information Commission replaced the Information Commissioner on 30 September 2026. source

What is the maximum UK GDPR fine?

£17.5 million or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher (Data Protection Act 2018, section 157). source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to UK GDPR (RSS)