- Understand why the UK and EU now have separate GDPR regimes.
- See what has stayed the same and what has changed in practice.
- Learn which law applies to your organisation.
- Compare regulators, data transfers, cookies, automated decision-making and DSARs.
- Avoid common compliance mistakes when operating across both jurisdictions.
One of the biggest misconceptions after Brexit is that the UK GDPR and EU GDPR are either completely different or effectively identical. Neither view is quite right.
The two frameworks still share the same core principles and most of the same obligations. What has changed is the detail — and detail is where compliance work happens. Divergence now affects cross-border business, international transfers, regulatory oversight and routine processes.
Timing matters. Most comparisons describe the position as it stood in 2024, before the bulk of the UK’s reforms took effect on 5 February 2026 — precisely when the gap widened. This guide covers the differences as they stand today, each tied to official guidance or legislation, in the evidence-first spirit Vorexa brings to policy change.
UK GDPR vs EU GDPR at a glance
| Area | EU GDPR | UK GDPR |
|---|---|---|
| Primary regulator | National supervisory authorities, coordinated by the European Data Protection Board (EDPB) | Information Commissioner’s Office (ICO) |
| Territorial scope | EU and organisations caught by Article 3 | UK and organisations caught by the UK territorial provisions |
| Cross-border regulation | One-Stop-Shop may apply within the EU | No participation in the EU One-Stop-Shop |
| International transfer tools | Standard Contractual Clauses (SCCs) where required | International Data Transfer Agreement (IDTA) or UK Addendum |
| Core principles and individual rights | Broadly aligned | Broadly aligned |
Day-to-day compliance remains familiar for many organisations. The differences bite when data crosses jurisdictions, or when automated systems make consequential decisions about people.
Why are there two versions of GDPR?
When the UK left the European Union, it retained the GDPR framework in domestic law. UK data protection is now governed principally by the UK GDPR alongside the Data Protection Act 2018, as GOV.UK’s overview of the UK’s data protection legislation sets out.
Parliament has since amended it. The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025 and amends — rather than replaces — the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). The ICO confirms these provisions are now in force, commenced in stages.
Two changes are still landing: a compliant data protection complaints procedure is required from 19 June 2026, and the ICO is due to become the Information Commission.
The result is gradual divergence, not a separate privacy framework. And it is no longer one-way — the EU is revising its own rules too.
What has stayed the same?
Despite increasing divergence, the foundations remain largely aligned.
- Core data protection principles.
- Lawful bases for processing.
- Individual rights such as access, rectification and erasure.
- Accountability obligations.
- Requirements for appropriate organisational and technical measures.
Both regimes still require personal data to be processed lawfully, fairly and transparently, under principles such as data minimisation and purpose limitation. The best evidence is external: in December 2025 the European Commission assessed the UK framework as amended by the DUAA and found it still essentially equivalent to the EU’s.
What actually differs in practice?
Regulators and enforcement
The UK GDPR is enforced by the Information Commissioner’s Office. Within the EU, each Member State has its own supervisory authority, coordinated through the European Data Protection Board.
The EU side is about to become more structured. Regulation (EU) 2025/2518 brings harmonised procedural rules for cross-border enforcement — common admissibility criteria, defined timeframes, clearer rights to be heard — from 2 April 2027. UK cases sit outside it entirely.
The end of the One-Stop-Shop for the UK
UK organisations no longer benefit from the EU’s One-Stop-Shop mechanism. Suppose a software company serves customers in the UK and Germany: depending on the circumstances, it may need to deal separately with the ICO and the relevant EU supervisory authority.
That need not mean duplicate programmes. It does mean two regulator relationships, two sets of guidance, and no single authority to escalate to.
International data transfers
This is the most important operational difference — and the one most often described with stale information.
Data can still flow from the European Economic Area to the UK under EU adequacy decisions, renewed on 19 December 2025 and now running until 27 December 2031, with a review after four years. ICO guidance on receiving personal information from the EEA confirms this is a full adequacy finding, so EEA organisations can transfer to the UK without safeguards or a derogation — and, unlike the 2021 decision, it covers immigration control data.
Adequacy is convenient but not permanent — it carries a sunset clause and is monitored throughout. Where it is unavailable, appropriate transfer mechanisms apply.
- EU GDPR generally relies on Standard Contractual Clauses (SCCs).
- UK GDPR uses the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs where appropriate.
The ICO explains when each should be used. If you already use EU SCCs, the Addendum is usually the lighter route, and an EU transfer impact assessment can inform — not replace — the UK transfer risk assessment.
Cookie rules
This has changed more than most summaries acknowledge. Since 5 February 2026, PECR has carried further exceptions to the consent requirement: cookies used solely for statistical purposes to improve the service, cookies that adapt a service’s appearance or functionality to user preferences, and cookies enabling emergency assistance.
They are narrower than they sound. The first two require clear information and a free, straightforward opt-out, and apply only where the cookie serves that purpose alone — analytics that also feed advertising still need consent. Meanwhile the maximum PECR penalty has risen from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. The rules relaxed and the stakes rose on the same day.
Serving both markets, don’t assume one implementation satisfies both. Applying the stricter EU standard everywhere is simplest — though it declines a relaxation the UK deliberately offered.
Automated decision-making
This is now the clearest point of divergence. Section 80 of the DUAA replaced Article 22 of the UK GDPR with Articles 22A–22D, in force from 5 February 2026.
The default has flipped. Under the EU GDPR, solely automated decisions with legal or similarly significant effects are broadly prohibited unless a narrow exception applies. Under the UK regime they are permitted for ordinary personal data provided safeguards are met: individuals must be told, and be able to make representations, obtain human intervention and contest the outcome. Stricter conditions still apply where a decision rests wholly or partly on special category data.
Expectations are not settled, though: the ICO consulted on draft guidance during 2026, and Article 22D lets the Secretary of State define terms such as “meaningful human involvement” by secondary legislation. For decisioning deployed in both markets, the EU standard remains the safer build.
Data Subject Access Requests (DSARs)
The UK has put two long-standing practices on a statutory footing: controllers need only carry out a reasonable and proportionate search, and the one-month clock can be paused while awaiting clarification that is genuinely required.
This is less dramatic than it sounds, as it largely codifies existing ICO guidance and case law. Clarification cannot be sought on a blanket basis, and any pause should be documented.
Which law applies to your organisation?
Start with where the people whose data you process are located, and whether you target them.
- UK-only business serving UK customers: Usually UK GDPR.
- Business established in the EU serving EU individuals: Usually EU GDPR.
- Organisation serving both UK and EU individuals: Both regimes may apply to different processing activities.
- Business outside Europe targeting UK and EU users: Territorial scope may bring both regimes into play.
Assess individual processing activities rather than assuming one law replaces the other.
Practical examples
Example: UK online retailer selling into France
A retailer based in Manchester begins actively marketing to customers in France. Its headquarters remain in the UK, but EU GDPR obligations may apply to processing for those customers, while UK GDPR governs processing involving UK individuals. The cookie banner is where divergence bites first: one website, two consent standards.
Example: Software company with UK and EU customers
A SaaS provider runs one platform but serves clients across Europe. Its privacy programme may stay largely unified, yet it still needs to consider:
- appropriate transfer mechanisms;
- the relevant supervisory authority;
- whether UK and EU representatives are required;
- whether any automated decisioning falls under Article 22 or Articles 22A–22D;
- which legal framework applies to each processing activity.
Common compliance mistakes
- Assuming Brexit removed all EU GDPR obligations.
- Using the wrong international transfer documentation.
- Ignoring which regulator has jurisdiction.
- Assuming one cookie implementation automatically satisfies both regimes.
- Treating the UK’s relaxed automated decision-making rules as applying to EU processing.
- Failing to monitor UK legislative developments.
Practical compliance checklist
- Review where your customers and users are located.
- Map cross-border personal data flows.
- Confirm whether adequacy or contractual safeguards apply.
- Review transfer agreements regularly.
- Check that a compliant data protection complaints procedure is in place.
- Update privacy notices where legal obligations differ.
- Monitor ICO and European regulatory guidance for future changes.
Frequently asked questions
Does EU GDPR still apply to UK businesses?
Yes, if it falls within the territorial scope of the EU GDPR — for example by offering goods or services to people in the EU, or monitoring their behaviour.
Can one privacy notice cover both regulations?
Often yes, provided it accurately reflects the obligations in each jurisdiction. Some use separate notices where processing differs significantly — particularly now that UK notices must explain the right to complain to the controller.
Do I always need both SCCs and the UK Addendum?
Not necessarily. The right mechanism depends on the transfer and the regime governing it, and adequacy may remove the need for either. The ICO’s guidance on standard data protection clauses covers this in detail.
Conclusion
The gap remains narrower than many headlines suggest, but it is no longer accurate to treat the two regimes as interchangeable. Within one jurisdiction the differences may be modest. Across both, regulator relationships, transfers, cookie practices and automated decision-making need separate consideration.
Here is the part most guides get wrong. Divergence is framed as the UK drifting from a fixed EU standard — but the EU is moving too. Its Digital Omnibus proposals of November 2025 would amend the GDPR and relocate cookie rules into it; they remain contested and under negotiation, so nothing there is settled law. The answer is neither two compliance programmes nor a bet on where either regime lands. It is one governance framework that knows where the rules diverge, records why each decision was taken, and is reviewed whenever guidance changes. Build for divergence as a permanent condition, not a temporary inconvenience.
