UK GDPR & Data Protection Act 2018
The UK's version of the GDPR, retained in domestic law after Brexit and read alongside the Data Protection Act 2018. It mirrors the EU regulation closely, with enforcement and guidance provided by the ICO rather than an EU supervisory authority.
Who it applies to
- Organisations processing personal data of people in the UK
- Public authorities, businesses and third-sector organisations
- Non-UK organisations offering goods or services to UK residents
Key requirements
- Lawful basis for processing, documented and reviewable
- DPO appointment where UK GDPR Article 37 thresholds are met
- 72-hour breach notification to the ICO
- Data Protection Impact Assessments for high-risk processing
- Respecting the same core data subject rights as EU GDPR
Maximum penaltyUp to £17.5 million or 4% of global annual turnover, whichever is higher
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The UK GDPR applies to: Organisations processing personal data of people in the UK; Public authorities, businesses and third-sector organisations; Non-UK organisations offering goods or services to UK residents.
The core obligations are: Lawful basis for processing, documented and reviewable; DPO appointment where UK GDPR Article 37 thresholds are met; 72-hour breach notification to the ICO; Data Protection Impact Assessments for high-risk processing; Respecting the same core data subject rights as EU GDPR. Each is summarised in plain English above, with a link to the official text.
Effective: 1 January 2021 (post-Brexit retained law). Regulator: Information Commissioner's Office (ICO).
Up to £17.5 million or 4% of global annual turnover, whichever is higher.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the UK GDPR, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, where the UK GDPR expects a Data Protection Officer, DPO as a Service can provide a named, accredited one; rights requests and consent records sit in Consents Manager.
See how Praeferre automates UK GDPR compliance
Continuous monitoring, evidence and reporting for UK GDPR — alongside every other framework you need to satisfy.