Key Facts
- Regulator
- Information Commission (UK GDPR), which replaced the Information Commissioner on 30 September 2026
- Latest version
- Regulation (EU) 2016/679 of 27 April 2016, published in OJ L 119, 4.5.2016. The UK keeps its own revised text, the UK GDPR, which UK legislation has amended.
- Effective
- 4 May 2016
- Official text
- eur-lex.europa.eu ↗
What is GDPR?
The UK GDPR is the UK's version of the General Data Protection Regulation, the law on how organisations handle personal data. The EU publishes the original as Regulation (EU) 2016/679; legislation.gov.uk publishes the UK text. Each binds controllers and processors within its scope, and a UK firm selling into the EU can be caught by both.
The EU text is Regulation (EU) 2016/679 of 27 April 2016, published in OJ L 119 on 4 May 2016 and applying from 25 May 2018. The UK keeps its own revised text, the UK GDPR, which UK legislation has amended. The two are now separate regimes, so "GDPR" can mean either one.
The UK GDPR has been amended by the Data (Use and Access) Act 2025. Under those changes, the Information Commission replaced the Information Commissioner as the UK GDPR's regulator on 30 September 2026. The ICO says its UK GDPR guidance is under review and may change, so check the date on any guidance you rely on.
Why it matters
A customer's questionnaire asks whether you are GDPR compliant. For a UK firm selling into the EU, two texts sit behind that question, and they are no longer the same.
Penalties show how seriously the law is meant. The EU GDPR's highest tier is up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. It covers breaches of the basic principles, data subjects' rights and international transfers. In the UK the maximum fine for breaching the principles is £17.5 million or 4% of worldwide annual turnover, whichever is higher.
Fines are not the only exposure. The regulation makes the controller responsible for being able to demonstrate compliance, so a gap in the paperwork is a problem in its own right.
Saying you comply is not the same as being able to show it.
Who it applies to
GDPR is mandatory law, not a voluntary framework. The EU GDPR is binding in its entirety and directly applicable in all EU Member States. The UK GDPR is the UK's retained version, and it is the law for UK controllers and processors.
The EU GDPR applies in two main ways:
- Establishment. It applies to processing in the context of the activities of a controller or processor established in the EU, wherever the processing takes place.
- Targeting. It also reaches controllers and processors outside the EU that offer goods or services to people in the EU, or monitor their behaviour there.
A firm with no EU establishment, no EU customers and no monitoring of people in the EU sits outside the EU text. It is still inside the UK GDPR if it is a UK controller or processor.
ISO 27001 is a certifiable management system for information security, not a law about personal data. Its nearest control, A.5.34 Privacy and protection of PII, covers meeting legal privacy requirements such as the GDPR's, so a certificate can support your evidence without making you compliant.
The UK position
A UK firm meets GDPR in three ways, and the second and third often overlap:
| Regime | Who it affects | What it asks |
|---|---|---|
| UK GDPR | UK controllers and processors | The EU regulation as it stood at the end of the Brexit transition period, adapted for the UK. For example, Article 27 covers representatives of controllers or processors not established in the United Kingdom |
| Data (Use and Access) Act 2025 | Anyone subject to the UK GDPR | Amends the UK GDPR, for example on purpose limitation and automated decision-making; the ICO is reviewing its guidance |
| EU GDPR Article 3(2) | UK firms offering goods or services to people in the EU, or monitoring their behaviour there | Compliance with the EU GDPR as well as the UK GDPR |
For a UK SaaS firm of 25 to 250 people, the usual first encounter is a data processing clause or questionnaire from a customer, not a regulator.
Key requirements
The regulation is long, but its structure rests on a short list of principles and a few duties that follow from them.
The seven principles
Article 5 sets out the data protection principles. The ICO counts seven under the UK GDPR:
- Lawfulness, fairness and transparency. Process personal data on a valid basis, treat people fairly and tell them what you do.
- Purpose limitation. Collect data for specified purposes and do not use it in incompatible ways.
- Data minimisation. Hold only what you need.
- Accuracy. Keep data accurate and up to date.
- Storage limitation. Do not keep identifiable data longer than needed.
- Integrity and confidentiality. Keep data secure against unauthorised access, loss and damage.
- Accountability. The controller is responsible for, and must be able to demonstrate, compliance with the other principles.
A privacy notice is not a compliance programme. Accountability is the principle that asks for the programme.
Duties that follow
- Security. Article 32 requires appropriate technical and organisational measures for the personal data you process.
- Breach notification. A personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of the controller becoming aware of it.
- Individual rights. People can ask for access to their data and, in some circumstances, its erasure.
Each duty comes back to the accountability principle: the regulator will want records, not assurances.
Frequently asked questions
The seven principles are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Article 5(1) of the GDPR lists the first six, and Article 5(2) adds accountability in a paragraph of its own, which is why some summaries of the GDPR list six principles plus accountability.
Yes. The EU GDPR is a regulation, so it applies directly in every EU Member State without national implementing law. It replaced the 1995 Data Protection Directive (95/46/EC), which each country had written into its own law. The UK GDPR is the UK's retained version, amended by UK legislation and published as revised UK law.
The UK GDPR is the EU regulation as it stood at the end of the Brexit transition period, adapted for the UK and amended since, including by the Data (Use and Access) Act 2025. The EU GDPR is Regulation (EU) 2016/679. They are now separate regimes with different texts, and the UK maximum fine is £17.5 million rather than EUR 20 million.
A UK company that processes personal data is subject to the UK GDPR. If it offers goods or services to people in the EU, or monitors their behaviour there, the EU GDPR applies too, and Article 27 usually requires it to designate a representative in the EU in writing. The exception is occasional, low-risk processing without large-scale special category or criminal offence data.
The Information Commission oversees the UK GDPR, having replaced the Information Commissioner on 30 September 2026. UK GDPR guidance is still published on the ICO website. In the EU, each Member State has at least one independent supervisory authority, and a breach is notified to the competent one. A UK firm under both regimes may have to deal with both.
No. ISO 27001 certifies an information security management system, while GDPR is law covering how personal data is processed. GDPR says an approved certification mechanism may be used as an element in showing Article 32 security compliance, but the text names no standard. ISO 27001 can support GDPR evidence; it does not replace it.