If your UK business handles personal data belonging to customers in Ireland, Germany, or the Netherlands, you’re working under two data protection laws at the same time: EU GDPR and UK GDPR. They started out almost identical after Brexit. They are not anymore. The differences now affect your lawful basis, your transfer paperwork, how you handle automated decisions, and which regulator you answer to.
The totals are getting hard to ignore. As of March 2026, the CMS GDPR Enforcement Tracker recorded 2,685 fines, with cumulative fines reaching approximately €6.11 billion. Across 2018–2026, the average fine was around €2.28 million, though that figure is heavily influenced by a small number of very large penalties. Ireland’s Data Protection Commission fined Google €403 million in September 2026 over how it processed location data. In Sweden, the data protection authority fined Miljödata i Karlskrona around €160,000 for insufficient technical and organisational security measures. Regulators are not only targeting the biggest names.
Take a made-up example. A small software company in Manchester has twelve staff and a growing client list across Europe. One Tuesday morning, the operations manager forwards an email. A customer in the Netherlands wants to see every piece of personal data the company holds about them, and expects a response within a month. Nobody on the team has handled a request like this before. If something goes wrong further down the line, which regulator might the business have to answer to?
For a small team without in-house legal support, the challenge is knowing what to do next without having to work through pages of regulation.
By the end of this blog, you’ll understand where EU GDPR and UK GDPR differ and what those differences mean for a UK business.
What Are EU GDPR and UK GDPR?
What Is the EU GDPR?
The EU General Data Protection Regulation is the privacy law covering the European Union and the European Economic Area. It became applicable on 25 May 2018 and governs how organisations collect, use, store, and share personal data. Each member state runs its own data protection regulator, and those regulators coordinate through a shared EU body called the European Data Protection Board.
What Is the UK GDPR?
The UK GDPR is based on the EU GDPR retained in UK law after Brexit, with subsequent amendments to fit the UK’s legal framework. It sits alongside the Data Protection Act 2018 and covers processing that falls within the UK’s reach. Since 30 September 2026, the Information Commissioner has held the regulator’s statutory functions under new governance arrangements. The organisation continues to be known publicly as the Information Commissioner’s Office (ICO).
For a few years after Brexit, the two sets of rules ran almost side by side, nearly identical. That’s no longer quite true. The Data (Use and Access) Act 2025 changed parts of the UK’s data protection framework, with its data protection provisions now in force. The main principles remain similar. The day-to-day details aren’t quite the same anymore.
Is There a Difference Between UK GDPR and EU GDPR?
Where the Laws Are Similar
The foundation is shared. Both rest on the same principles:
- Process data lawfully and fairly, and be transparent about how it is used.
- Collect data for stated reasons rather than quietly reusing it for something else.
- Gather only what’s needed and keep it accurate.
- Delete data once it’s no longer needed and keep it secure.
- Be able to show that these principles are being followed.
Both laws give people similar rights too, including the right to see their personal data, correct it, have it erased, limit how it’s used, transfer it to another service in certain circumstances, and object to certain uses.
Where the Laws Diverge
The main legal differences are set out below.
Recognised legitimate interest.
UK GDPR now has five statutory conditions for this lawful basis. They cover voluntary disclosures for another organisation’s public tasks, national security, public security and defence, emergency response, crime detection and offender handling, and safeguarding vulnerable people. When a condition applies, you don’t need the usual balancing test, but you must still show the processing is necessary and the condition’s requirements are met. The EU GDPR has no equivalent list.
Automated decision-making.
The UK rules now allow certain decisions made solely by automated processing where an appropriate lawful basis applies and the required safeguards are met. These decisions are ones that have a legal or similarly serious effect on a person. The safeguards include telling people about the decision, letting them make representations and challenge it, and giving them access to human intervention. Recognised legitimate interest cannot be used as the basis for these decisions. EU GDPR Article 22 generally prohibits decisions based solely on automated processing with legal or similarly serious effects unless a specific exception applies. The EU rules remain tighter.
What does this mean in practice? A process that meets UK rules may not meet EU rules. If you handle data under both laws, review your policies and check both before relying on the same approach.
Who Does Each Law Apply To?
EU GDPR Territorial Scope
EU GDPR can apply to a business outside the EU if it offers goods or services to people in the EU or monitors their behaviour there. A UK retailer actively selling to customers in Ireland may fall under EU GDPR for that activity. The same may apply to a UK software firm tracking people’s behaviour in Germany. The test depends on where the organisation is established and what its processing involves, not just where the company happens to sit.
UK GDPR Territorial Scope
UK GDPR follows a similar approach for the UK. It covers businesses established in the UK, as well as organisations outside the UK that offer goods or services to people here or monitor their behaviour.
Organisations Operating in Both the UK and EU
A UK company selling into the EU may need to satisfy EU GDPR for processing covered by that law, while UK GDPR continues to apply to processing within its own scope. An EU group with a UK subsidiary may face a similar situation, depending on how its businesses operate and handle personal data. When personal data moves across that border, the business may also need to check whether international transfer rules apply.
Key Differences Between EU GDPR and UK GDPR
1. Who Enforces the Law?
EU GDPR is enforced by each member state’s own data protection regulator. Under the one-stop-shop system, a business carrying out cross-border processing will usually deal with one lead authority, although other regulators can still be involved in certain cases.
In the UK, the Information Commissioner handles notifications and other regulatory functions under UK GDPR. The organisation continues to be known publicly as the Information Commissioner’s Office (ICO).
2. The Laws That Sit Alongside GDPR
EU GDPR works alongside the ePrivacy Directive, which covers areas such as cookies and electronic marketing, as well as national laws in individual countries.
In the UK, the main laws to know are:
- Data Protection Act 2018, which works alongside UK GDPR.
- Privacy and Electronic Communications Regulations (PECR), which cover areas such as cookies and electronic marketing.
- Data (Use and Access) Act 2025, which amended parts of the UK’s data protection framework.
The UK reforms also allow certain cookies and similar technologies to be used without consent where specific conditions are met, including some technologies used solely for statistical purposes or to adapt a service’s appearance or functions to a user’s preferences. These exceptions are purpose-specific, may require clear information and, in some cases, a simple and free means to object, and do not exempt all analytics, advertising or functionality cookies.
3. Moving Data Across Borders
The EU renewed its adequacy decision for the UK on 19 December 2025. It runs until 27 December 2031, unless amended, withdrawn or renewed.
An adequacy decision means the European Commission considers a country’s data protection standards sufficient for personal data transfers. While the EU’s adequacy decision for the UK remains in force, transfers within its scope can take place without additional transfer safeguards. Other EU GDPR obligations, including having a lawful basis and meeting transparency and security requirements, still apply.
Transfers from the UK to the EEA rely on the UK’s own transfer rules. Where the destination is covered by UK adequacy regulations, additional transfer safeguards are not required, but the other data protection obligations still apply.
Businesses handling data across borders should check the ICO’s current international transfer guidance rather than rely on older transfer procedures.
4. The Paperwork for Transfers
When a transfer is not covered by an adequacy decision or another permitted exception, businesses may need additional safeguards. The options differ between the two regimes.
- EU GDPR: Standard Contractual Clauses (SCCs), which are approved contract terms for certain international transfers, or Binding Corporate Rules for transfers within multinational groups.
- UK GDPR: The International Data Transfer Agreement (IDTA), a UK Addendum that can be attached to the EU’s SCCs, or UK Binding Corporate Rules.
These tools aren’t automatically interchangeable. If a business uses EU SCCs for a transfer covered by UK GDPR, it may need the UK Addendum or another valid UK transfer mechanism. UK transfer documents alone do not automatically meet EU GDPR requirements.
When relying on appropriate safeguards, organisations must assess whether the required level of data protection will be maintained after the transfer. UK law uses a ‘not materially lower’ test, while EU law applies its own transfer requirements, including the ‘essentially equivalent’ standard. One assessment may support compliance with both regimes if it meets the requirements of each.
5. Reporting a Data Breach
Both laws generally require organisations to notify the regulator of a personal data breach without undue delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to pose a risk to people’s rights and freedoms.
The main difference is who receives the notification. Under EU GDPR, a lead supervisory authority usually handles cross-border processing cases, although other regulators may also be involved. In the UK, the Information Commissioner’s Office handles notifications.
A breach affecting processing under both laws may require separate notifications.
6. Appointing a Data Protection Officer
Both laws require a Data Protection Officer (DPO) in similar circumstances. These include when an organisation’s main activities involve large-scale, regular and systematic monitoring of people, or large-scale processing of sensitive data such as health records or biometric data used to uniquely identify people.
The Data (Use and Access) Act 2025 did not remove the UK’s DPO requirement.
Most small businesses won’t need a formal DPO unless they meet one of the legal conditions. They still need someone to oversee data protection, and they may need to keep records of their processing activities.
7. What a Data Breach Could Cost
For the most serious infringements, EU GDPR allows fines of up to €20 million or four per cent of an undertaking’s total worldwide annual turnover in the preceding financial year, whichever is higher. Under UK GDPR, the equivalent maximum is £17.5 million or four per cent of total worldwide annual turnover in the preceding financial year, whichever is higher. Lower maximums apply to some other types of infringement.
The maximum fine is not what every business should expect to pay. Regulators consider factors such as the nature and seriousness of the breach, how long it lasted, and the circumstances of the case. A smaller business should not assume that its size alone will protect it from enforcement.
EU GDPR vs UK GDPR: Compliance Comparison
| Requirement | EU GDPR | UK GDPR |
| Lead regulator | Data protection authority in each EU country, with a lead authority for qualifying cross-border processing | Information Commissioner (the organisation continues to use the ICO name publicly) |
| Main principles | Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, accountability | Largely the same, carried over from the EU framework |
| Data-subject rights | Access, rectification, erasure, restriction, portability, objection | Largely the same, with UK-specific procedural changes |
| International transfers | EU adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, derogations | UK adequacy regulations, UK IDTA or UK Addendum, Binding Corporate Rules, derogations |
| Breach reporting | Notify the competent supervisory authority, including the lead authority where applicable | Notify the Information Commission where required |
| Maximum fine | Up to €20 million or 4% of global annual turnover, whichever is higher | Up to £17.5 million or 4% of global annual turnover, whichever is higher |
| Recognised legitimate interest | No equivalent list of pre-approved recognised legitimate interests | Five statutory conditions, subject to specific requirements |
| Significant solely automated decisions | Restrictions apply under Article 22, subject to its conditions and exceptions | Wider choice of lawful bases, with safeguards; recognised legitimate interest cannot be used for these decisions |
Core Compliance Requirements Under Both Laws
Lawful Basis and Privacy Notices
A lawful basis is needed for every processing activity. EU GDPR has six standard lawful bases. UK GDPR keeps those six and adds recognised legitimate interest as an additional lawful basis under the Data (Use and Access) Act 2025, subject to five statutory conditions. This UK-specific basis doesn’t apply to processing governed by EU GDPR, so a business operating under both laws may need a separate EU lawful basis for the same activity.
Privacy notices need to explain what’s collected, why, how long it’s kept, and who sees it, in language a customer can understand rather than legal wording copied from a template. The UK reforms also set out when further use of data can be treated as compatible with its original purpose, including for certain research activities. Transparency duties may still apply to maintain compliance with applicable data protection requirements.
Data Subject Rights
Data subject rights work in much the same way under both laws. People can ask what’s held, get mistakes fixed, have data deleted, limit its use, take it elsewhere, or object to certain uses.
The UK reforms clarify when the response period for a subject access request starts and allow the deadline to pause if the organisation reasonably needs clarification. Organisations must also carry out reasonable and proportionate searches for personal data. These rules do not allow them to delay requests unnecessarily or ignore information that may fall within the request.
Data Minimisation and Retention
Collecting only what’s needed and clearing it out once it’s served its purpose matters under both laws. A retention schedule, which states how long each type of data should be kept and when it should be deleted or reviewed, helps put this principle into practice. The schedule needs to reflect the purpose of the data and any legal or business requirements for keeping it.
Security Measures
Security has to match the actual risk involved. Weak controls such as missing multi-factor authentication, inadequate encryption and delayed security updates can increase the risk of a data breach.
The Swedish Miljödata case is a good example. The fine of around €160,000 came down to insufficient technical and organisational measures to keep data secure.
Practical measures include:
- Using multi-factor authentication where appropriate.
- Encrypting personal data where needed to protect it.
- Applying security updates and patches promptly.
Organisations still need to assess the risks to the personal data they hold and choose suitable technical and organisational safeguards under the law.
Privacy by Design and Risk Assessments
Privacy needs building into systems from the start rather than bolted on later. The UK reforms add a specific duty to consider children’s higher protection needs when designing online services likely to be accessed by children.
A record of what data is held, where it came from and where it goes also helps with subject access requests and transfer checks. Higher-risk processing may require a data protection impact assessment (DPIA) beforehand. The UK and EU rules are similar, but businesses working under both should check the applicable requirements rather than assume one assessment will automatically meet both sets of obligations.
Contracts and Breach Response
Contracts between a business and anyone processing data on its behalf need to spell out each party’s responsibilities. A breach response plan should also be in place before an incident happens, with clear roles for assessing the risk, deciding whether the regulator must be notified, and contacting affected people where required.
Handling Data Protection Complaints
UK organisations must provide a way for people to raise data protection complaints. They must acknowledge a complaint within 30 days, investigate it without undue delay, and tell the person the outcome. This is a UK-specific requirement introduced by the Data (Use and Access) Act 2025, so businesses operating under both regimes should account for it in their UK procedures.
How to Comply with Both EU GDPR and UK GDPR
A few practical moves cover most of what’s needed here, without a total rebuild of an existing compliance setup.
1. Map Your Data and Check Your Contracts
Start with a data map showing where personal data comes from, where it goes, and which data protection rules may apply to each processing activity. A single customer database can contain information processed under both laws, depending on the business’s activities and how it handles that data.
Keep transfer documentation for each jurisdiction separate rather than filing one agreement and assuming it covers both. Review privacy notices and supplier contracts so they reflect both laws accurately. Check that any supplier handling both UK and EU data has terms covering both, not just whichever one they’re more familiar with.
2. Test Security Controls and Prepare for Breaches
Put security controls in place and actually test them rather than leaving a policy document unread in a drawer. Build a breach response plan that sets out which regulator may need to be notified, based on the processing involved and the applicable law.
Keep a log of every personal data breach, including incidents that don’t need to be reported, and document why a notification wasn’t required.
3. Review Your Compliance Regularly
None of this is a one-time job either. The Data (Use and Access) Act 2025’s data protection changes have been brought into force through staged commencement regulations. The ICO continues to update its guidance as needed. Transfer procedures and documents should be reviewed when the rules or circumstances change, rather than left untouched after the first compliance review. A review that was accurate earlier in 2026 may need updating by the end of the year.
For businesses without an in-house legal team, getting help from people who work with cybersecurity and compliance can make these tasks easier to manage. Qualysec, for example, can support the security testing side of the work, while the business still needs to check its legal obligations under both regimes.
How Qualysec Helps Businesses Achieve GDPR Compliance
Once you know what compliance looks like, the next question is practical. Can you actually show it? Qualysec works on the security and evidence side of GDPR compliance, the part regulators and customers ask about when something goes wrong.
- Penetration testing and vulnerability assessments. Qualysec tests your web, mobile, API and cloud environments to find exploitable weaknesses before attackers do. This supports the GDPR Article 32 2duty to test and evaluate your security measures regularly.
- Evidence that testing actually happened. Plenty of businesses test their systems but can’t prove it later. Qualysec helps you document security testing so the controls described in your policies and DPIAs match what’s actually running.
- Security input for DPIAs. A DPIA only works if the safeguards it lists are real. Qualysec’s assessments test whether your technical controls match the risks you’ve identified.
- Compliance readiness support. Qualysec works with frameworks including OWASP, NIST, ISO 27001, SOC 2 and GDPR. This is readiness support, not a formal certification audit. Qualysec does not certify you against ISO 27001 or SOC 2, but it helps you build and evidence the security controls those frameworks expect.
- Retesting and remediation records. Finding a vulnerability is only useful if it gets fixed. Retesting and clear reporting help you close the loop and keep a record you can show customers or regulators.
To be clear, Qualysec doesn’t give legal advice on lawful bases, transfer mechanisms or regulator strategy. Instead, it helps you build the technical evidence that regulators and customers increasingly ask for under both EU and UK GDPR.
Conclusion
The owner in Manchester didn’t think data protection was her problem until that email from the Netherlands landed. The request itself wasn’t the hard part. Not knowing which rulebook applied, who to answer to, or whether existing paperwork even covered it, that was the hard part.
The difference between EU GDPR and UK GDPR is no longer just a concern for legal teams. It affects lawful bases, transfer paperwork, automated decision-making and breach reporting, including for small businesses that handle data across the UK and EU. None of this needs a large compliance department to get right. It needs someone who knows where the data goes, understands where the two laws differ, and keeps the paperwork up to date.
Getting help with these questions can make it easier to understand which rules apply and where security testing may be needed. Qualysec can help with the security testing side, while the business remains responsible for its data protection compliance.
Frequently Asked Questions
1. Is UK GDPR the Same as EU GDPR?
No. They share the same basic principles, but UK GDPR differs from the EU version on recognised legitimate interest, automated decision-making and some international transfer rules. Businesses working under both laws need to check which rules apply to each activity.
2. Does EU GDPR Still Apply After Brexit?
Yes. EU GDPR can still apply to UK businesses that offer goods or services to people in the EU or monitor their behaviour there. Brexit did not remove these requirements, but the law applies only to processing that falls within its territorial scope.
3. Can Personal Data Move Freely Between the UK and EU?
Generally, yes, for transfers covered by the current adequacy arrangements. The EU’s decision allows covered EEA-to-UK transfers without additional transfer safeguards and runs until 27 December 2031, unless extended. The UK also permits covered transfers to the EU and EEA without additional safeguards. Other data protection obligations still apply, including having a lawful basis and maintaining appropriate security.
4. Which GDPR Applies to a UK Company Serving EU Customers?
Potentially both. UK GDPR may apply to the company’s UK operations, while EU GDPR may apply to processing covered by its territorial scope, such as offering goods or services to people in the EU. The answer depends on the company’s activities and how it processes personal data.
