UK GDPR vs EU GDPR: Where the Regimes Now Diverge

Since the Data (Use and Access) Act 2025 took effect, the UK GDPR and the EU GDPR are no longer the same law with different flags, and organisations operating in both markets can no longer assume one set of controls satisfies both. The two regimes still share their structure, principles and most article numbers, which is exactly why the differences are easy to miss: a lawful basis, an automated decision, a cookie banner or a subject access search can be compliant in London and non-compliant in Dublin. This guide tracks the divergences that matter in practice, the transfer rules in both directions, representatives and enforcement, breach notification for incidents that touch both regimes, and how to choose between a single global baseline and regime-specific controls. It is written for privacy, security and compliance teams in organisations subject to both laws. For the UK regime on its own, see the UK GDPR and Data Protection Act 2018 Guide.

Status as of 14 November 2026: the Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Most of its data protection part commenced on 5 February 2026 (SI 2026/82), the ICO states that all of the Act's data protection provisions were in force by 19 June 2026, and from 30 September 2026 the office of Information Commissioner was abolished and its functions transferred to the Information Commission (SI 2026/1015). On the EU side, the European Commission renewed its UK adequacy decisions on 19 December 2025, with an expiry of 27 December 2031 unless extended. On 19 November 2025 the Commission also published a Digital Omnibus proposal of technical amendments across EU digital legislation; check its legislative status before planning around any change it may make. Both positions can change, so confirm against the official sources listed at the end.

Key takeaways

Same skeleton, different rules at the edges. Principles, rights, Article 32 security and 72-hour breach reporting are aligned; lawful bases, automated decisions, cookies, research and access request searches now differ.
The UK moved towards flexibility, the EU did not follow. Recognised legitimate interests, wider lawful bases for significant automated decisions and new cookie exemptions are UK-only. Applying them to EU data subjects is a breach of the EU GDPR.
EU to UK transfers still flow freely. The renewed adequacy decisions run to 27 December 2031, with a review due at least four years after adoption. UK to rest-of-world transfers use a reworded "not materially lower" test and the IDTA or UK Addendum.
Two regulators, no one-stop-shop across the Channel. A UK firm without an EU establishment deals with EU authorities individually and may need an EU representative; an EU firm targeting UK individuals without a UK establishment may need a UK representative.
Decide your baseline deliberately. Most dual-regime firms keep the stricter EU position as the default and apply UK flexibilities only to clearly UK-only processing, documented as a regime-specific exception.

The divergence map at a glance

The table lists the differences that most often change a control, a contract or a record. Article references are to each regime's GDPR text; UK references reflect the amendments made by the 2025 Act.

Topic	EU GDPR	UK GDPR (as amended)	What changes in practice
Legitimate interests	Art. 6(1)(f): always a balancing test against individuals' interests and rights	Adds recognised legitimate interests (DUAA s.70 and Schedule 4): for listed purposes, such as public security, no balancing test is needed	A UK legitimate interests assessment can be shorter for listed purposes; the EU assessment cannot
Significant automated decisions	Art. 22: right not to be subject to solely automated decisions with legal or similarly significant effects, subject to listed exceptions	Arts. 22A to 22D (DUAA s.80): any lawful basis may be used with safeguards, except where special category data is involved	An AI decision process lawful in the UK on legitimate interests may need contract, law or explicit consent in the EU
Subject access searches	Art. 15 right of access	Controllers need only make reasonable and proportionate searches	Document search scope per regime; do not narrow EU searches on the UK standard
Complaints	Complaints go to supervisory authorities (Art. 77)	Controllers must facilitate complaints, acknowledge within 30 days and respond without undue delay (DUAA s.103)	UK needs an internal complaints route and log
Cookies and similar technologies	ePrivacy Directive Art. 5(3): consent unless strictly necessary	PECR as amended: some cookies, such as statistical or functionality cookies, can be set without consent	Geo-split consent behaviour, or keep EU consent for everyone
Scientific research	Research provisions in Art. 89 and recitals	Clearer research definitions including commercial research, broad consent to an area of research, privacy notice exemption for disproportionate effort if published online	Research programmes need regime-specific consent wording
Transfers out	Adequacy (Art. 45), SCCs (Art. 46(2)(c)), BCRs, derogations	Adequacy regulations under the "data protection test" (Arts. 45A to 45C), IDTA or UK Addendum, BCRs	Separate transfer tools and risk assessments per regime
Regulator	National supervisory authorities, coordinated by the EDPB, one-stop-shop via a lead authority (Art. 56)	Information Commission (previously the ICO) with new interview and report powers	Two enforcement relationships, two sets of guidance
Maximum fines	Up to EUR 20 million or 4% of worldwide annual turnover (Art. 83(5)), lower tier EUR 10 million or 2%	Up to GBP 17.5 million or 4% (DPA 2018 s.157), lower tier GBP 8.7 million or 2%; PECR penalties now follow the DPA 2018 regime	Both regimes can fine for the same incident

For the full list of 2025 Act changes and their commencement regulations, see the UK Data Act 2025 Guide. This page covers only how they create divergence from the EU.

Lawful basis and automated decisions: the divergences most likely to bite

Recognised legitimate interests

Risk: a group-wide privacy notice or legitimate interests assessment written on the UK model removes the balancing test for processing that also covers EU residents. Control: keep one legitimate interests assessment per processing activity, with a regime field. Where the purpose is a recognised legitimate interest, note it for UK data and still complete the balancing test where EU data is in scope. See the Legitimate Interests Assessment Template.

Automated decision-making and AI

Risk: this is the largest practical gap for AI systems and agents. In the UK, the ICO describes the change as allowing the full range of lawful bases for significant automated decisions, with appropriate safeguards, but not for special category data. The EU GDPR keeps the Article 22 structure, where solely automated significant decisions are permitted only on its listed exceptions. Architecture in words: the model or agent is the same; the decision policy that wraps it differs. A credit, hiring or pricing decision that runs fully automated for UK applicants may need meaningful human review, or a different legal basis, for EU applicants. Control: tag each automated decision flow with the regimes it serves, record the lawful basis and safeguards per regime, and enforce human review in the workflow for EU cases rather than in a policy document. See the AI and GDPR Guide and, for the separate AI law question, UK AI Regulation vs EU AI Act.

Access requests and complaints

The UK confirms that controllers need make only reasonable and proportionate searches when answering a subject access request, and requires an internal complaints process with acknowledgement within 30 days. A shared request handling platform should store the regime for each request, apply the right search scope and run the UK complaints clock. See the DSAR Guide: Handling Data Subject Requests.

International transfers in both directions

Transfers are where divergence carries the most legal risk, because both regimes treat an unlawful transfer as a higher-tier infringement.

Flow	Mechanism as of November 2026	Practical notes
EU or EEA to UK	EU adequacy decision under GDPR Art. 45, renewed 19 December 2025, expiring 27 December 2031 unless extended; a separate decision under the Law Enforcement Directive	No SCCs needed while adequacy stands. The renewed GDPR decision also covers transfers for UK immigration control purposes. Keep a contingency plan: the Commission monitors UK developments and must review the decision at least four years after adoption.
UK to EU or EEA	UK adequacy regulations	No additional transfer tool needed.
UK to other third countries	UK adequacy regulations under Arts. 45A and 45B, or appropriate safeguards under Art. 46: the IDTA, the UK Addendum to the EU SCCs, or BCRs	The IDTA and the Addendum came into force on 21 March 2022. The ICO's guide covers transfer risk assessments.
EU to other third countries	Commission adequacy decisions, the 2021 SCCs, BCRs, derogations	Transfer impact assessment expected under the EU approach. See the Standard Contractual Clauses (SCCs) Guide.

The reworded UK test: under the new Art. 45B, the standard of protection in the destination must be "not materially lower" than under the UK regime, and the Secretary of State must consider factors including the rule of law and human rights, an enforcing authority, redress, onward transfer rules, international obligations and the destination's constitution, traditions and culture. Art. 46 safeguards use the same threshold. The ICO says the rewording does not materially change how organisations can use personal information, so existing UK transfer risk assessments remain a sound base.

Dual contracts: a supplier receiving both EU and UK data needs the EU SCCs plus the UK Addendum, or the SCCs plus a separate IDTA. Track both in the transfer register, with an owner and review date. See the Transfer Impact Assessment (TIA) Template and the International Data Transfers Map.

Representatives, establishment and enforcement

UK representative: controllers or processors outside the UK with no UK establishment, who offer goods or services to people in the UK or monitor their behaviour, must appoint a UK representative in writing. Public authorities are exempt, as is processing that is only occasional, low risk and not large-scale use of special category or criminal offence data. Appointing one does not reduce the controller's own liability; publish the representative's details in the privacy notice.
EU representative: the mirror rule in EU GDPR Art. 27 applies to UK organisations with no EU establishment that target or monitor people in the EU, with equivalent exemptions in Art. 27(2).
One-stop-shop: the EU lead authority mechanism in Art. 56 depends on a main establishment in the EU. A UK organisation without one can face each EU authority where affected individuals are located. Establishing a genuine EU main establishment is a structural decision, not a paperwork exercise.
Enforcement styles: the Information Commission now has powers to compel witnesses to attend interviews and to require reports from approved persons, which the ICO said it would use in the most serious cases. EU authorities coordinate cross-border cases through the EDPB. Expect separate investigations, separate findings and potentially separate fines for the same incident.

Breach notification for incidents that cross both regimes

The breach rules themselves are aligned: notify the supervisory authority within 72 hours of awareness unless the breach is unlikely to result in a risk to individuals, and notify individuals where the risk is high. The divergence is in who you notify.

Classify affected individuals by regime at the start of the incident, from the system of record, not from guesswork.
Notify the Information Commission for UK data subjects within the 72-hour window.
Notify in the EU: the lead authority if you have an EU main establishment, otherwise each relevant authority. Prepare these templates in advance, because the 72-hour clock runs in parallel.
Keep one fact base: the same timeline, scope and containment record must support every notification, or regulators will compare inconsistent accounts.
Check PECR and sector rules: communications providers have separate PECR breach duties; see the PECR Guide and the Breach Notification Laws by Country Guide.

A leaked API key or service account credential that exposes a customer database is the common modern trigger. Logging which non-human identities can reach which datasets, by regime, is what lets you scope the notification inside 72 hours.

Choosing a dual-compliance model

Model	How it works	Best fit	Trade-offs
Single strictest baseline	Apply the EU position everywhere, ignore UK flexibilities	Groups with mainly EU data subjects, or a single platform serving both markets	Simplest to run and audit; forgoes UK flexibility on cookies, research and automated decisions
Baseline plus UK deltas	EU default, with documented UK-only exceptions for clearly UK-only processing	Most organisations with distinct UK products or customer bases	Requires reliable regime tagging of data and users; each delta needs an owner and review date
Fully separate programmes	Independent UK and EU policies, notices, records and processes	Separately run UK and EU entities with separate systems	Highest cost; risk of drift and inconsistent incident handling

Decision criteria: choose the single baseline if you cannot reliably determine which regime applies to a record at processing time. Choose baseline plus deltas only when the UK flexibility delivers a concrete benefit, such as cookie analytics without a consent banner for UK-only sites or automated decisions in a UK-only product, and the system can enforce the split. Small organisations should almost always choose the single baseline. For EU national differences layered on top, see GDPR Variations in Six EU Member States.

Worked scenario: a UK-headquartered software firm with no EU office sells to customers in the UK, Ireland and Germany. It keeps EU GDPR as the baseline, appoints an EU representative, and runs separate transfer clauses for EU and UK data with its US hosting provider (the 2021 SCCs plus the UK Addendum). Its marketing site uses UK cookie exemptions for analytics only when the visitor is in the UK, and its automated fraud screening routes EU applicants to human review. When a leaked deployment credential exposes a support database, it notifies the Information Commission and both the Irish and German authorities from one incident record within 72 hours.

Implementing and measuring

Map regimes: for each entity and processing activity, record whether the UK GDPR, the EU GDPR or both apply, and why (establishment, targeting, monitoring). Use the Record of Processing Activities (ROPA) Template with a regime column.
Pick the model from the table above and get it approved by the DPO and legal counsel.
Inventory deltas: list every place a UK flexibility is used, with owner, justification and review date.
Enforce in systems: geo or account-based logic for cookies, decision routing for automated decisions, request handling with regime fields.
Refresh contracts and notices: transfer clauses per regime, representative details, references to the Information Commission.
Rehearse a dual notification: a tabletop that ends with UK and EU notifications drafted from one fact base.
Roll back safely: keep the previous EU-standard configuration for any UK delta so it can be reverted if challenged or if the regimes realign.

Regime coverage: percentage of processing activities with a recorded regime.
Delta hygiene: number of UK-only deltas, and the percentage with a current owner and review date.
Transfer coverage: percentage of restricted transfers with a valid tool for each regime that applies.
Notification readiness: time in exercises from awareness to drafted UK and EU notifications, target well under 72 hours.
Complaints performance: percentage of UK complaints acknowledged within 30 days.

Common failure patterns

Group policy written on the UK model: recognised legitimate interests or relaxed automated decision rules applied to EU customers.
One cookie configuration for all visitors: UK exemptions applied to EU traffic.
Treating adequacy as permanent: no contingency for EU to UK flows if the 2031 decision is not renewed or is challenged.
Missing representatives: UK firms selling into the EU, or EU firms selling into the UK, with no Article 27 appointment and no details in the privacy notice.
Notifying only one regulator: an incident affecting UK and EU individuals reported only to the Information Commission.
Machine identities outside the record: service accounts and AI agents moving data across borders without appearing in the transfer register.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Identifying applicable legal regimes	GV.OC-03	PT-2	A.5.31, A.5.34
Records of processing and data mapping	ID.AM-07	PM-5	A.5.9, A.5.12
Transfers and supplier contracts	GV.SC-05	SA-9	A.5.19, A.5.20
Breach notification	RS.CO-02, RS.CO-03	IR-6	A.5.24, A.5.26

Practitioner checklist

Record, for every entity and processing activity, whether the UK GDPR, the EU GDPR or both apply.
Choose and document a dual-compliance model, defaulting to the EU baseline when regime tagging is unreliable.
Keep a register of UK-only deltas with owners and review dates.
Route EU automated significant decisions to the Art. 22 exceptions or human review.
Split cookie behaviour by regime or keep EU consent for all visitors.
Hold EU SCCs and the UK Addendum or IDTA for suppliers receiving both data sets.
Appoint UK and EU representatives where required and publish their details.
Prepare UK and EU breach notification templates and rehearse them from one fact base.
Monitor the EU adequacy review and EU legislative proposals that could change the baseline.

Standards and references

Related NHI Mgmt Group resources: UK GDPR and Data Protection Act 2018 Guide · International Data Transfers Map · GDPR Variations in Six EU Member States · GDPR Compliance Guide for Security Teams. This guide summarises the differences between the UK GDPR, as amended by the Data (Use and Access) Act 2025, and the EU GDPR as of 14 November 2026 and is not legal advice.

UK GDPR vs EU GDPR: Where the Two Regimes Now Diverge