UK GDPR (UK GDPR)
The UK’s retained version of the GDPR, which, with the Data Protection Act 2018, governs personal data in the UK after Brexit.
Overview
UK GDPR mirrors the EU GDPR closely but is now amended separately by UK legislation. It is enforced by the Information Commissioner’s Office.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice. The authorities most closely connected to it are ICO. It is often read together with GDPR.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Firms in both markets must track two regimes that are drifting apart.
Who it affects
Organisations processing personal data of people in the UK.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to UK GDPR. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
UK GDPR and EU GDPR obligations share controls, with differences flagged.
Request early access →