The UK runs its own version of the GDPR (the UK GDPR) alongside the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. The Data (Use and Access) Act 2025 amended all three, with most changes in force from 5 February 2026 and a new duty to handle complaints directly from 19 June 2026. The regulator became the Information Commission on 30 September 2026 but is still known as the ICO. A UK GDPR programme built for the EU will mostly carry over, but transfer assessments, cookie banners, automated decision notices and complaint handling should be refreshed.
What law applies and what changed in 2026
The UK GDPR and the Data Protection Act 2018 remain the base framework. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends them rather than replacing them, so existing records of processing, privacy notices and data protection impact assessments remain the starting point.
The main changes took effect on 5 February 2026. They include a new lawful basis of recognised legitimate interests for listed purposes such as crime prevention and safeguarding, a more permissive framework for decisions based solely on automated processing (with rights to be told, to make representations and to obtain human intervention), and codification that subject access searches need only be reasonable and proportionate. Businesses using automated decision tools for hiring, credit or pricing should check that their notices and challenge routes meet the new Articles 22A to 22D.
From 19 June 2026 controllers must have a process for complaints made directly to them and must acknowledge a complaint within 30 days. In practice this means a documented intake channel and a response log, since the regulator can later require controllers to report complaint volumes.1234
Transfers of personal data out of the UK
A transfer is restricted only where the UK GDPR applies, the sender initiates the transfer or gives remote access, and the recipient is a separate legal entity. Sending data to your own staff abroad within the same company is not a restricted transfer, but sending it to an overseas parent, subsidiary or vendor is.
Restricted transfers need cover: transfer regulations made by the government (formerly adequacy), appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or a narrow exception. Since 5 February 2026 the benchmark is whether protection abroad is not materially lower than in the UK, and exporters relying on safeguards must apply that test reasonably and proportionately. This is a lower bar than the EU standard of essential equivalence, so a UK transfer risk assessment may be lighter than an EU one, but it still needs to be documented.56
Cookies, marketing and enforcement
Cookies and similar technologies still need consent unless an exception applies. A new exception covers cookies used only to collect statistics on how an organisation's own online service is used in order to improve it, which may allow some analytics to run without a banner choice. Advertising and cross-site tracking cookies still need consent.
The regulator's fining powers for marketing and cookie breaches under PECR now match those under the Data Protection Act 2018. The higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. This makes unlawful email, text and call marketing a board-level risk rather than a small-fine issue.789
The regulator
On 30 September 2026 the Information Commissioner's Office, previously a single office-holder, was replaced by the Information Commission, a body corporate governed by a board. The organisation is still known as the ICO and its functions have not changed, so existing registrations, guidance and contact routes continue. Contracts and policies that name the Information Commissioner do not need to be redrafted urgently, but new documents should refer to the Information Commission.10
| Change | In force | What to check |
|---|---|---|
| Recognised legitimate interests, automated decision-making, transfer test, cookie exceptions, PECR fines | 5 February 2026 | Lawful bases, decision notices, transfer risk assessments, cookie banner |
| Data subject complaints to controllers | 19 June 2026 | Complaint channel, 30-day acknowledgement, log |
| ICO replaced by the Information Commission | 30 September 2026 | References in new contracts and policies |
Documents usually needed
- Record of processing activities and UK privacy notice
- Transfer risk assessment and UK IDTA or UK Addendum for each overseas recipient
- Cookie inventory and consent records
- Complaint-handling procedure and complaints log
- Automated decision-making notice and human review procedure where relevant
Common mistakes
- Assuming EU standard contractual clauses alone cover UK transfers without the UK Addendum or IDTA.
- Treating every analytics cookie as exempt: the new exception is limited to statistics used to improve the organisation's own service.
- Leaving no route for data subjects to complain directly to the business now that a complaints process is required.
- Treating PECR marketing breaches as low risk; fines now follow the Data Protection Act 2018 maximums.
- Copying an EU transfer risk assessment without recording the UK not materially lower test.
When the business crosses borders
- Groups serving both the UK and the EU need parallel transfer paperwork: EU standard contractual clauses for EU exports and the UK IDTA or Addendum for UK exports.
- Remote access from abroad to UK-held data counts as a transfer when the person accessing it works for a separate legal entity.
- Non-UK businesses that target UK individuals can fall under the UK GDPR even without a UK establishment.
Questions businesses ask
Has the UK replaced the GDPR?
No. The Data (Use and Access) Act 2025 amends the UK GDPR, the Data Protection Act 2018 and PECR. Most changes have applied since 5 February 2026.12
Who regulates data protection in the UK now?
The Information Commission, which took over the ICO's functions on 30 September 2026 and still operates as the ICO.10
Do we still need a transfer mechanism to send data to a US or Indian group company?
Yes, if it is a separate legal entity. Use transfer regulations where they cover the destination, or appropriate safeguards such as the IDTA or Addendum backed by a transfer risk assessment applying the not materially lower test.56
What this guide does not yet confirm
These points need checking with a qualified local professional in the United Kingdom before you rely on them.
- The ICO website could not yet be checked for this research beyond one transfer page, so the current data protection fee tiers, the 72-hour breach reporting guidance and the list of UK transfer regulations (adequacy countries) were not confirmed.
- Cyber security rules (the Network and Information Systems Regulations 2018 and the Cyber Security and Resilience Bill) and the planned UK e-invoicing mandate were not confirmed and are not covered here.
- Whether the controller complaint rules apply to complaints about processing before 19 June 2026 depends on the transitional provisions in SI 2026/82.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations rather than replacing them. UK-wide. Commenced in four stages between August 2025 and 2026.
The commencement page describes amendments to the existing instruments; the factsheets describe changes article by article to the UK GDPR and DPA 2018.
Most of the Act's Part 5 data protection and privacy changes came into force on 5 February 2026, including recognised legitimate interests, the new automated decision-making rules, the international transfer changes, the cookie exceptions and the PECR enforcement changes. Brought into force by regulation 2 of SI 2026/82 so far as not already in force; transitional provisions limit some changes for conduct before commencement.
The new right for data subjects to complain directly to controllers (section 103 of the Act) came into force on 19 June 2026. Applies to controllers subject to the UK GDPR and Data Protection Act 2018.
Controllers must have a process for handling data protection complaints made directly to them, acknowledge a complaint within 30 days and take appropriate steps to respond. The Secretary of State may later require controllers to report complaint numbers to the regulator.
For transfers outside the UK, the test is now whether protection in the destination is not materially lower than under UK law, and exporters relying on safeguards such as standard clauses must apply that test acting reasonably and proportionately. Applies to transfers approved by regulations (formerly adequacy) and to transfers subject to appropriate safeguards. The four-year adequacy review cycle was removed.
A transfer is a restricted transfer only if the UK GDPR applies to the processing, the sender initiates the transfer or makes UK-held data accessible abroad (including remote access), and the receiver is a separate legal entity; it must then be covered by transfer regulations, appropriate safeguards or an exception. Sending data to the organisation's own employees abroad within the same legal entity is not a restricted transfer.
Page metadata dated 15 January 2026.
The higher maximum UK data protection penalty is £17,500,000 or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher; the standard maximum is £8,700,000 or 2%. Turnover alternative applies to undertakings; which maximum applies depends on the provision infringed.
Enforcement powers and fines under the Privacy and Electronic Communications Regulations (marketing, cookies) are aligned with those under the Data Protection Act 2018. Direct marketing breaches can be fined even if the call or message does not reach its recipient.
In force date taken from SI 2026/82 (section 115 and Schedule 13).
Consent is no longer needed for cookies used only to collect statistics on how an organisation's own online service is used in order to improve it; other non-essential cookies still need consent. Exceptions now sit in new Schedule A1 to PECR; the Secretary of State can add or amend exceptions by regulations.
The Information Commissioner's Office as a corporation sole was abolished and its functions moved to the Information Commission, a body corporate with a board, from 30 September 2026. The organisation continues to be known as the ICO and its regulatory role is unchanged.
Local Government Lawyer (30 September 2026) reports that the change took effect on that date and that the organisation is known as the Information Commission's Office.
Questions on this topic
10 statements on data protection, transfers and cyber in the United Kingdom
