--- title: "EU GDPR vs UK GDPR: limited to the cited sources compliance comparison" canonical_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr" source_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr" author: "Sorena AI" description: "Compare EU GDPR obligations with UK GDPR transfer notes based on EU GDPR sources, covering scope, lawful basis, rights, accountability, records, DPIAs, security, and transfers." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "EU GDPR" - "UK GDPR" - "GDPR comparison" - "lawful basis" - "data subject rights" - "RoPA" - "DPIA" - "SCC" - "adequacy decisions" - "GDPR" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # EU GDPR vs UK GDPR: limited to the cited sources compliance comparison Compare EU GDPR obligations with UK GDPR transfer notes based on EU GDPR sources, covering scope, lawful basis, rights, accountability, records, DPIAs, security, and transfers. *Artifact Guide* *EU* ## EU GDPR vs UK GDPR This comparison helps separate cited EU GDPR duties from UK GDPR transfer facts that appear in the available EU GDPR cited sources. The EU side covers scope, lawful basis, rights, controller and processor accountability, security, DPIAs, records, and transfers. UK-side claims are intentionally limited to the cited sources where the cited sources do not include UK GDPR or ICO guidance. This page is an EU GDPR-first comparison. It states GDPR obligations only where the available EU GDPR sources support them, and it keeps UK GDPR comparator facts narrow: this folder supports UK transfer and adequacy notes, but not a full UK GDPR obligation matrix. ## EU GDPR vs UK GDPR: what is official source here Use the EU side as an official source GDPR obligation map. Use the UK side only for transfer and adequacy comparator points supported by the available EU GDPR cited sources. - **EU GDPR**: The EU column is based on the GDPR text and EU-focused guidance for lawful basis, rights, accountability records, DPIAs, security, breach response, transfers, and enforcement. - **UK GDPR**: The UK column is intentionally limited to the cited sources. This folder supports UK transfer and adequacy references, but not a complete UK GDPR duties, rights, procedure, or penalty matrix. | Dimension | EU GDPR | UK GDPR | Operational implication | Sources | | --- | --- | --- | --- | --- | | Scope boundary | EU GDPR applies to processing of personal data by controllers and processors, including processing in the context of an EU establishment and non-EU offering or monitoring of people in the Union. | Not fully based on this folder. Before relying on UK GDPR scope, add a UK-specific legal source; this page only grounds UK-related transfer references from Commission materials. | Do not treat EU scope and UK scope as automatically identical. Write an EU scope finding now and leave the UK scope finding open until UK-specific sources are attached. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the need to test EU GDPR applicability against the processing facts.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the limited UK transfer/adequacy context, not a full UK GDPR scope test. | | Covered actors | EU GDPR evidence should identify controllers, processors, joint controllers, processor instructions, Article 28 contracts, Article 30 records, DPO involvement where applicable, and the owner responsible for each processing activity. | Not fully official source here. If UK GDPR roles are in scope, attach UK-specific role and contract sources before reusing the EU controller or processor conclusion. | One data map can support both workstreams, but each role label and contract obligation needs its own cited source. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds controller, processor, joint-controller, processor-contract, DPO, and accountability provisions.
[Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports maintaining complete, self-contained processing records rather than scattered references.
[European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports only the limited UK SCC comparator point, not a complete UK role analysis. | | Trigger | EU GDPR work should identify the Article 6 lawful basis, provide transparent information, facilitate rights under Articles 15 to 22, and keep logs showing how requests were received, verified, answered, or refused. | Not official source here beyond the fact that UK transfer material exists in Commission sources. Do not infer UK rights clocks, exemptions, or ICO handling procedures from this EU folder. | Reuse request tooling only after each jurisdiction has its own rights source, response clock, exception analysis, and escalation path. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds separate EU GDPR lawful-basis and rights evidence.
[Irish DPC - Guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports identifying consent, contract, legal obligation, vital interests, public task, or legitimate interests before processing.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only UK adequacy context, not UK rights procedures. | | Core obligations | EU GDPR work should tie Article 32 security measures to the processing risk, run a DPIA where processing is likely to create high risk, retain residual-risk and consultation decisions, and record personal-data-breach assessments. | Not fully official source here. Do not infer UK breach notification procedures, DPIA consultation steps, or authority-specific forms from these EU sources. | Security controls may be shared operationally, but DPIA, breach, and authority-contact records should show which jurisdictional source they satisfy. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds Article 32 security, Article 33 breach notification, and Article 35 DPIA requirements.
[CNIL - Privacy Impact Assessment](https://www.cnil.fr/en/privacy-impact-assessment-pia?ref=sorena.io) - Supports DPIA triggers for processing likely to result in high risk.
[ENISA - Guidelines for SMEs on the security of personal data processing](https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing?ref=sorena.io) - Supports linking security controls to the risk of the personal-data processing operation.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the UK adequacy context and does not ground UK breach or DPIA procedures. | | Evidence record | EU GDPR evidence can include the scope memo, lawful-basis analysis, rights log, RoPA, processor contract, DPIA, Article 32 security record, breach assessment, transfer file, and supervisory-authority correspondence. | Reuse is not blocked, but it is not self-proving. UK reuse needs UK-specific source labels unless the evidence concerns the limited Commission-cited transfer facts on this page. | Keep shared evidence operationally reusable and legally labelled. If a UK source is missing, mark the item as EU-official source only. | [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports keeping mandatory record information clear and retrievable.
[Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the EU GDPR duties that determine what evidence belongs in the pack.
[European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports limited transfer-related reuse only where the SCC evidence matches the cited transfer fact. | | Timing and deadlines | EU GDPR transfer planning should start with Chapter V: adequacy decisions, SCCs or other safeguards, transfer impact assessment where SCCs are used, supplementary measures where needed, and evidence that the mechanism matches the data flow. | Official source only for transfer comparison: Commission materials list the United Kingdom in adequacy materials and mention UK endorsement of EU SCCs with limited domestic adaptations. | Treat UK transfer notes as a comparator input, not as a complete UK transfer legal opinion. Keep adequacy, SCC, TIA, and supplementary-measure files separate by jurisdiction. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds Chapter V transfer rules under EU GDPR.
[European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports keeping transfer mechanism evidence tied to the specific transfer.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports UK adequacy references in the EU transfer context. | | Enforcement | EU GDPR supervisory authorities have corrective powers and administrative fines. The GDPR text sets EU fine tiers of up to EUR 10,000,000 or 2 percent of worldwide annual turnover, and up to EUR 20,000,000 or 4 percent, depending on the infringement. | Not official source here. The cited sources do not support UK authority procedures, UK penalty levels, or UK national variants. | Escalate EU GDPR enforcement exposure from the GDPR text. Leave UK enforcement exposure blocked until a UK-specific source is added. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports EU-only enforcement escalation until UK-specific cited support is available.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy_decisions_en?ref=sorena.io) - Does not ground UK enforcement or penalties; included to show the only UK-related source available in this folder. | | Overlap and reuse | EU and UK teams can often reuse the same operational artifacts, but each artifact still needs a separate legal label. A RoPA, DPIA, transfer file, or breach log can travel across workstreams only if the supporting source is clear. | For UK reuse, record the Commission adequacy or SCC reference only when the item is actually about transfer or adequacy. Do not stretch those sources to cover unrelated UK scope or rights questions. | Shared workflows are fine; shared citations are not. Reuse the same document, but keep the jurisdiction tag and supporting source attached to each conclusion. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Articles 24, 30, 32 and 33 support reusable operational records for EU GDPR compliance.
[European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports the limited UK comparator point for transfer-related reuse only.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports limiting UK reuse to adequacy and transfer references from Commission materials. | | Practical decision rule | EU GDPR applies to processing of personal data by controllers and processors, including processing in the context of an EU establishment and non-EU offering or monitoring of people in the Union. | Not fully based on this folder. Before relying on UK GDPR scope, add a UK-specific legal source; this page only grounds UK-related transfer references from Commission materials. | Do not treat EU scope and UK scope as automatically identical. Write an EU scope finding now and leave the UK scope finding open until UK-specific sources are attached. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the need to test EU GDPR applicability against the processing facts.
[European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the limited UK transfer/adequacy context, not a full UK GDPR scope test. | Sources for Scope boundary - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Articles 2 and 3 ground material and territorial scope for EU GDPR. - Quote: "Territorial scope" Sources for Scope boundary - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the limited UK transfer/adequacy context, not a full UK GDPR scope test. - Quote: "United Kingdom" Sources for Scope boundary - operational implication: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the need to test EU GDPR applicability against the processing facts. - Quote: "processing activities" Sources for Covered actors - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds controller, processor, joint-controller, processor-contract, DPO, and accountability provisions. - Quote: "controller or processor" - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports RoPA as an accountability record for controllers and processors. - Quote: "demonstrate accountability" Sources for Covered actors - UK GDPR: - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports only the limited UK SCC comparator point, not a complete UK role analysis. - Quote: "United Kingdom" Sources for Covered actors - operational implication: - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports maintaining complete, self-contained processing records rather than scattered references. - Quote: "complete, self-contained document" Sources for Trigger - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds Article 6 lawful bases and Articles 12 to 22 data-subject-rights handling. - Quote: "Rights of the data subject" - [Irish DPC - Guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports identifying consent, contract, legal obligation, vital interests, public task, or legitimate interests before processing. - Quote: "legal basis" Sources for Trigger - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only UK adequacy context, not UK rights procedures. - Quote: "United Kingdom" Sources for Trigger - operational implication: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds separate EU GDPR lawful-basis and rights evidence. - Quote: "lawfully, fairly and in a transparent manner" Sources for Core obligations - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds Article 32 security, Article 33 breach notification, and Article 35 DPIA requirements. - Quote: "Security of processing" - [CNIL - Privacy Impact Assessment](https://www.cnil.fr/en/privacy-impact-assessment-pia?ref=sorena.io) - Supports DPIA triggers for processing likely to result in high risk. - Quote: "high risk" - [ENISA - Guidelines for SMEs on the security of personal data processing](https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing?ref=sorena.io) - Supports risk-based security measures for confidentiality, integrity, and availability of personal data. - Quote: "confidentiality, integrity and availability" Sources for Core obligations - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the UK adequacy context and does not ground UK breach or DPIA procedures. - Quote: "United Kingdom" Sources for Core obligations - operational implication: - [ENISA - Guidelines for SMEs on the security of personal data processing](https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing?ref=sorena.io) - Supports linking security controls to the risk of the personal-data processing operation. - Quote: "risk-based approach" Sources for Evidence record - EU GDPR: - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports complete RoPA records as a core accountability artifact. - Quote: "standalone record" - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the EU GDPR duties that determine what evidence belongs in the pack. - Quote: "demonstrate compliance" Sources for Evidence record - UK GDPR: - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports limited transfer-related reuse only where the SCC evidence matches the cited transfer fact. - Quote: "EU SCCs" Sources for Evidence record - operational implication: - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports keeping mandatory record information clear and retrievable. - Quote: "make the record available" Sources for Timing and deadlines - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds Chapter V transfer rules under EU GDPR. - Quote: "Transfers of personal data" - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports SCCs as pre-approved clauses for EU transfers to third countries. - Quote: "appropriate data protection safeguards" Sources for Timing and deadlines - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports UK adequacy references in the EU transfer context. - Quote: "United Kingdom under the GDPR" - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports the limited statement that the Commission page mentions UK endorsement of EU SCCs with domestic adaptations. - Quote: "endorsed the EU SCCs" Sources for Timing and deadlines - operational implication: - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports keeping transfer mechanism evidence tied to the specific transfer. - Quote: "data transfers from the EU" Sources for Enforcement - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds EU GDPR supervisory authority powers and administrative fine tiers. - Quote: "administrative fines" Sources for Enforcement - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy_decisions_en?ref=sorena.io) - Does not ground UK enforcement or penalties; included to show the only UK-related source available in this folder. - Quote: "United Kingdom" Sources for Enforcement - operational implication: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports EU-only enforcement escalation until UK-specific cited support is available. - Quote: "effective, proportionate and dissuasive" Sources for Overlap and reuse - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Articles 24, 30, 32 and 33 support reusable operational records for EU GDPR compliance. - Quote: "demonstrate compliance" Sources for Overlap and reuse - UK GDPR: - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports the limited UK comparator point for transfer-related reuse only. - Quote: "United Kingdom" Sources for Overlap and reuse - operational implication: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports limiting UK reuse to adequacy and transfer references from Commission materials. - Quote: "adequacy decision" Sources for Practical decision rule - EU GDPR: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Articles 2 and 3 ground material and territorial scope for EU GDPR. - Quote: "Territorial scope" Sources for Practical decision rule - UK GDPR: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Supports only the limited UK transfer/adequacy context, not a full UK GDPR scope test. - Quote: "United Kingdom" Sources for Practical decision rule - operational implication: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the need to test EU GDPR applicability against the processing facts. - Quote: "processing activities" ### How should teams decide whether one evidence pack is enough? - Use one shared evidence pack only when each item has a source label for every jurisdiction it supports. - For EU GDPR, label scope, lawful basis, rights, RoPA, DPIA, security, breach, transfer, and enforcement evidence from the cited EU sources. - For UK GDPR, reuse only transfer and adequacy points based on the Commission sources on this page unless a UK-specific source has been added. - Mark UK scope, rights, authority procedure, national derogation, breach process, and penalty claims as blocked until UK-specific source support exists. Sources for the practical decision rule: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the EU GDPR evidence categories used in the decision rule. - Quote: "demonstrate compliance" - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Grounds the limited UK adequacy comparator point. - Quote: "United Kingdom" - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Grounds the limited UK SCC comparator point. - Quote: "endorsed the EU SCCs" ## How to use this comparison Start with the EU GDPR fact pattern: whether personal data is processed, which controller or processor is responsible, which lawful basis applies, which rights can be exercised, whether Article 30 records are required, whether a DPIA or security review is needed, and whether Chapter V transfer rules apply. For UK GDPR, do not copy EU conclusions into a UK workstream from this page alone. The available EU GDPR folder grounds UK-related transfer points through European Commission adequacy and SCC materials, but it does not include a standalone UK GDPR text or ICO guidance source. - Use the EU column as the primary obligation checklist. - Use the UK column only for comparator facts explicitly supported by the cited Commission transfer sources. - Keep separate evidence labels when the same RoPA, DPIA, transfer file, contract, or security record is reused across jurisdictions. - Add a UK-specific source review before making UK scope, rights, enforcement, penalty, or authority-process decisions. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds EU GDPR scope, principles, lawful bases, rights, controller and processor duties, records, security, DPIAs, transfers, supervisory powers, and fines. - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Grounds the limited UK comparator point that the Commission adequacy page lists the United Kingdom under GDPR-related adequacy materials. ## Evidence records to keep separate The most useful output is not a generic statement that the regimes are similar. It is a labelled evidence pack showing which source supports each conclusion. For EU GDPR, keep the Article 6 lawful-basis analysis, privacy notice basis, rights workflow, RoPA, processor terms, DPIA or no-DPIA rationale, Article 32 security measures, breach assessment, transfer mechanism, and supervisory-authority response history as distinct records. - Record the processing purpose, data categories, data subjects, recipients, transfers, erasure timing, and security measures in the RoPA. - Keep consent evidence only where consent is actually the chosen lawful basis; otherwise record the selected Article 6 basis and why it fits. - Keep DPIA scoping, risk assessment, mitigation decisions, residual risk approvals, and consultation decisions together. - For transfers, keep the adequacy, SCC, transfer impact assessment, supplementary-measures, and importer-notification evidence separate from general vendor due diligence. Sources for this answer: - [Irish DPC - Guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Grounds the need to identify the correct legal basis before processing personal data. - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Grounds controller and processor RoPA requirements, including prescribed record contents and accountability use. - [CNIL - Privacy Impact Assessment](https://www.cnil.fr/en/privacy-impact-assessment-pia?ref=sorena.io) - Grounds the DPIA trigger for processing likely to result in high risk to rights and freedoms. ## Where the UK comparison is limited to the cited sources The available cited sources support only narrow UK comparator facts: the European Commission adequacy page lists the United Kingdom under GDPR adequacy materials, and the Commission SCC page says some jurisdictions, including the United Kingdom, have endorsed EU SCCs as a transfer mechanism with limited domestic adaptations. Do not infer UK GDPR lawful bases, data-subject-rights clocks, controller/processor wording, ICO procedures, national derogations, or UK penalty variants from those EU transfer sources. Those facts need UK-specific source support before publication or customer advice. - Supported UK comparator fact: EU transfer planning may need to consider Commission adequacy material for the United Kingdom. - Supported UK comparator fact: Commission SCC guidance mentions the United Kingdom in relation to EU SCC endorsement and national transfer clauses. - Unsupported in this folder: a full UK GDPR scope test, UK rights workflow, ICO enforcement route, UK breach procedure, UK penalty variants, or UK national derogations. Sources for this answer: - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Grounds UK adequacy references in the EU international-transfer context. - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Grounds the limited statement that the Commission page mentions UK endorsement of EU SCCs with domestic adaptations. ## Accountability checks before relying on one evidence pack A shared privacy evidence pack is useful only if it preserves the source for each claim. EU GDPR accountability evidence should show the controller decision, processor instructions, lawful basis, rights handling, Article 30 records, security measures, DPIA outcome, breach assessment, and transfer mechanism. Where a record is reused for UK GDPR work, label the UK source that supports the reuse. If that source is missing, mark the record as EU-official source only and queue a UK-specific review. - Name the controller, joint controller, or processor role for each processing activity. - Attach the Article 6 lawful basis and the evidence that supports it. - Show how data-subject rights requests are received, identified, routed, answered, and logged. - Keep Article 32 security measures and breach assessments tied to the specific processing activity. - For transfers, record whether adequacy, SCCs, or another Chapter V mechanism is being used. Sources for this answer: - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds controller and processor responsibilities, rights, records, security, DPIAs, breach notification, transfers, and enforcement provisions. - [ENISA - Guidelines for SMEs on the security of personal data processing](https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing?ref=sorena.io) - Grounds risk-based security evidence for personal-data processing, including confidentiality, integrity, and availability framing. *Recommended next step* *Placement: before sources* ## This comparison helps separate EU-official source and UK-cited claims Sorena can help turn the EU GDPR obligations and UK transfer notes on this page into labelled evidence requests, owner assignments, and review steps. - [Open Research Copilot for GDPR](/solutions/research-copilot.md): Ask questions tied to cited sources about GDPR scope, lawful basis, records, DPIAs, security, transfers, and evidence using the cited sources on this page. - [Talk through implementation](/contact.md): Review your EU GDPR and UK GDPR evidence labels, transfer files, and remaining source gaps with Sorena. ## Primary sources - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds the EU GDPR evidence categories used in the decision rule. - Quote: "demonstrate compliance" - [Irish DPC - Guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports identifying consent, contract, legal obligation, vital interests, public task, or legitimate interests before processing. - Quote: "legal basis" - [Irish DPC - Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports keeping mandatory record information clear and retrievable. - Quote: "make the record available" - [CNIL - Privacy Impact Assessment](https://www.cnil.fr/en/privacy-impact-assessment-pia?ref=sorena.io) - Supports DPIA triggers for processing likely to result in high risk. - Quote: "high risk" - [ENISA - Guidelines for SMEs on the security of personal data processing](https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing?ref=sorena.io) - Supports linking security controls to the risk of the personal-data processing operation. - Quote: "risk-based approach" - [European Commission - Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Grounds the limited UK SCC comparator point. - Quote: "endorsed the EU SCCs" - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?ref=sorena.io) - Grounds the limited UK adequacy comparator point. - Quote: "United Kingdom" - [European Commission - Adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy_decisions_en?ref=sorena.io) - Does not ground UK enforcement or penalties; included to show the only UK-related source available in this folder. - Quote: "United Kingdom" ## Related Topic Guides - [Does the EU GDPR apply outside the EU under Article 3?](/artifacts/eu/general-data-protection-regulation/faq/territorial-scope.md): An official source GDPR Article 3 territorial-scope FAQ covering EU establishment, offering goods or services, monitoring behavior in the EU, and Article 27 representatives. - [EU GDPR Applicability Test for Products, Vendors, and Data Flows](/artifacts/eu/general-data-protection-regulation/applicability-test.md): A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence. - [EU GDPR Article 30 RoPA Intake Workflow](/artifacts/eu/general-data-protection-regulation/ropa-intake-workflow.md): This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live. - [EU GDPR Article 6 Legal Bases FAQ](/artifacts/eu/general-data-protection-regulation/faq/legal-bases.md): FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data. - [EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence](/artifacts/eu/general-data-protection-regulation/automated-decision-making-and-profiling.md): cited GDPR guide for automated decision-making and profiling: Article 22 scope, profiling definition, transparency, lawful basis, DPIA triggers, human review rights, and evidence. - [EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow](/artifacts/eu/general-data-protection-regulation/breach-notification-72-hours.md): Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs. - [EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records](/artifacts/eu/general-data-protection-regulation/breach-notification-workflow.md): A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records. - [EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/checklist.md): This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence. - [EU GDPR Children and Special-Category Data Guide](/artifacts/eu/general-data-protection-regulation/children-and-special-categories.md): cited GDPR guide for Article 8 children's consent, Article 9 special-category data, DPIA triggers, transparency, safeguards, and evidence records. - [EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/compliance.md): Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties. - [EU GDPR Controller, Processor, and Joint Controller Roles](/artifacts/eu/general-data-protection-regulation/controller-processor-and-joint-controller-roles.md): cited GDPR guide for classifying controllers, processors, and joint controllers, with Article 28 contract checks, Article 26 transparency, and vendor evidence. - [EU GDPR Data Subject Rights and DSAR Workflow](/artifacts/eu/general-data-protection-regulation/data-subject-rights-and-dsar-workflow.md): cited GDPR DSAR workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor escalation, and evidence. - [EU GDPR deadlines and compliance calendar](/artifacts/eu/general-data-protection-regulation/deadlines-and-compliance-calendar.md): cited GDPR calendar entries for applicability, DSAR response timing, breach notification, DPIA review, prior consultation, transfer reviews, and retention checks. - [EU GDPR DPIA and Prior Consultation Workflow](/artifacts/eu/general-data-protection-regulation/dpia-and-prior-consultation-workflow.md): Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required. - [EU GDPR DPIA and risk management under Articles 35 and 36](/artifacts/eu/general-data-protection-regulation/dpia-and-risk-management.md): EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits. - [EU GDPR DSAR Exceptions: refusal, extensions, identity checks](/artifacts/eu/general-data-protection-regulation/faq/dsar-exceptions.md): FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15. - [EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence](/artifacts/eu/general-data-protection-regulation/dsar-workflow.md): Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records. - [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers](/artifacts/eu/general-data-protection-regulation/faq.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers. - [EU GDPR International Transfers and SCCs: Chapter V evidence guide](/artifacts/eu/general-data-protection-regulation/international-transfers-and-sccs.md): cited guide to GDPR Chapter V transfers, adequacy decisions, SCCs, transfer impact assessments, supplementary measures, and EU-US DPF checks. - [EU GDPR Lawful Basis and Consent Guide](/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent.md): Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records. - [EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lawful-basis-and-lia-workflow.md): Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f). - [EU GDPR Lead Supervisory Authority and One-Stop-Shop](/artifacts/eu/general-data-protection-regulation/lead-authority-and-one-stop-shop.md): How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together. - [EU GDPR LIA Template for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lia-template.md): This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence. - [EU GDPR penalties and fines: Article 83 tiers and evidence](/artifacts/eu/general-data-protection-regulation/penalties-and-fines.md): EU GDPR penalties and fines guide covering Article 83 fine tiers, assessment factors, Article 58 powers, and evidence records for controllers and processors. - [EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide](/artifacts/eu/general-data-protection-regulation/processor-contracts-and-vendor-management.md): EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable. - [EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields](/artifacts/eu/general-data-protection-regulation/record-of-processing-activities-template.md): Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures. - [EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers](/artifacts/eu/general-data-protection-regulation/requirements.md): Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers. - [EU GDPR Retention and Erasure Schedule](/artifacts/eu/general-data-protection-regulation/retention-and-erasure-schedule.md): Build an EU GDPR retention and erasure schedule around storage limitation, Article 17 erasure grounds, Article 12 rights handling, Article 19 recipient notices, and Article 30 RoPA fields. - [EU GDPR SCC Transfer Impact Assessment FAQ](/artifacts/eu/general-data-protection-regulation/faq/scc-transfer-impact-assessment.md): cited FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required. - [EU GDPR Transfer TIA and SCC Workflow](/artifacts/eu/general-data-protection-regulation/transfer-tia-and-scc-workflow.md): A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers. - [EU GDPR Transparency Notices: Articles 12, 13 and 14](/artifacts/eu/general-data-protection-regulation/transparency-notices.md): Official source GDPR guide to privacy notices under Articles 12, 13 and 14: direct collection, third-party data sources, recipients, transfers, retention, rights, and lawful basis. - [EU GDPR vs Brazil LGPD: GDPR-led comparison and source gaps](/artifacts/eu/general-data-protection-regulation/gdpr-vs-lgpd.md): Compare EU GDPR duties with Brazil LGPD only where the available sources support the comparator, with GDPR rows for lawful basis, rights, breach, transfers, roles, and evidence. - [EU GDPR vs California CCPA: official source GDPR comparison limits](/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa.md): Compare GDPR implementation duties with limited to the cited sources California CCPA/CPRA context, showing where the available cited sources support a claim and where it does not. - [EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications](/artifacts/eu/general-data-protection-regulation/gdpr-vs-eprivacy.md): Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance. - [GDPR processor vs controller: role boundaries and evidence](/artifacts/eu/general-data-protection-regulation/faq/processor-vs-controller.md): Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records. - [GDPR vs EU AI Act: privacy controls for AI systems](/artifacts/eu/general-data-protection-regulation/gdpr-vs-ai-act.md): Compare GDPR privacy duties with the EU AI Act only where the GDPR source pack supports the point: lawful basis, notices, DPIA, ADM, RoPA, rights, and source limits. - [GDPR vs EU Data Act: personal data safeguards and source limits](/artifacts/eu/general-data-protection-regulation/gdpr-vs-data-act.md): Compare GDPR obligations with the EU Data Act only where the available GDPR cited sources support the fact pattern, with clear safeguards for personal data, rights, transfers, and accountability. - [When does the EU GDPR require a DPIA?](/artifacts/eu/general-data-protection-regulation/faq/dpia-threshold.md): Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements. - [When does the GDPR 72-hour breach notification clock start?](/artifacts/eu/general-data-protection-regulation/faq/breach-awareness-clock.md): GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr