EU GDPR vs UK GDPR

Post-Brexit Data Protection

When the UK left the EU on January 31, 2020, it incorporated GDPR into domestic law through the European Union (Withdrawal) Act 2018, creating what is commonly known as "UK GDPR." The Data Protection Act 2018 supplements it, much as member state laws supplement EU GDPR.

Initially, EU GDPR and UK GDPR were identical. However, the UK is gradually introducing divergences through the Data Protection and Digital Information Act, which received Royal Assent in 2024.

Adequacy and Data Transfers

The EU granted the UK an adequacy decision in June 2021, valid until June 2025. This means data can flow freely from the EU to the UK without additional safeguards — for now. The decision is expected to be renewed, but companies should monitor this closely and have contingency plans.

For transfers in the other direction (UK to third countries), the UK has established its own "Data Bridge" framework. Rather than creating entirely new adequacy assessments, the UK extends existing EU adequacy decisions to cover UK data transfers. The UK has also developed the International Data Transfer Agreement (IDTA) as its own alternative to EU Standard Contractual Clauses.

Key Divergences

Fines: EU GDPR fines are denominated in euros (€20M), while UK GDPR fines are in pounds (£17.5M). At current exchange rates, the UK cap is slightly lower.

Children's consent age: The UK set the age of consent for data processing at 13, while EU GDPR defaults to 16 (though member states can lower it to 13).

ICO approach: The ICO has generally taken a more pragmatic, business-friendly enforcement approach compared to some EU DPAs. The ICO focuses on outcomes and proportionality, which can result in different enforcement priorities.

Emerging divergences: The Data Protection and Digital Information Act introduces changes around legitimate interest processing, automated decision-making, and research provisions that create meaningful differences from EU GDPR.

Practical Impact for Mid-Market Companies

For most mid-market companies serving both EU and UK customers, the practical differences remain small. The core compliance requirements — lawful basis, DSAR handling, breach notification, DPIAs — are functionally identical. The main action items are: (1) appoint both an EU representative and a UK representative if you lack an establishment in each jurisdiction, (2) use the appropriate transfer mechanism (EU SCCs for EU data, IDTA or UK Addendum for UK data), and (3) monitor the adequacy decision renewal in 2025.