UK GDPR
UK GDPR guide to scope, roles, lawful bases, rights, accountability, breaches, children, automated decisions, transfers, and amendments in force by February 2026.
UK GDPR is the UK's main ruleset for processing . It works with the Data Protection Act 2018, which supplements the regime with conditions, exemptions, enforcement powers, and separate rules for law-enforcement and intelligence processing.
Start with one processing activity: confirm Article 2 material scope and Article 3 territorial scope, identify and roles, choose the Article 6 basis and any Article 9 or 10 condition, then connect transparency, rights, accountability, security, breach, transfer, and sector-specific duties. The consolidated text includes the Data (Use and Access) Act 2025 changes brought fully into force for these topics on 5 February 2026, including Articles 22A-22D, Articles 44A-45C, and the children's higher-protection matters in Article 25.
Accountability framework, Article 30 documentation, and controls.
DSR operations, breach notification, and communication readiness.
IDTA and Addendum workflows plus the Children's Code implementation.
Test the processing activity against Article 2 and 3 scope, exclusions, UK establishment or UK targeting, and , joint-controller, or status.
Keep purpose and lawful-basis decisions, Article 9 or 10 conditions, notices, role and arrangements, records of processing, DPIAs, rights records, breach assessments, and transfer decisions. The required evidence depends on the activity and the organisation's role.
First confirm there is a transfer to a third country or international organisation. Then use approval regulations under Article 45A, an Article 46 safeguard such as the IDTA or UK Addendum, or a fact-specific Article 49 derogation, while checking any Article 49A restriction.
The chronology separates the original EU GDPR application, the UK's post-transition regime, transfer instruments, and later amendments. For operations, confirm scope and roles; document lawful basis and any special-category condition; run rights requests under the amended Article 12 and 12A timing rules; assess breaches against the separate ICO and individual-notice thresholds; and document the applicable Chapter V transfer route. Timeline dates are legal or policy milestones, not recurring internal review deadlines.
Start with a specific processing activity, scope, roles, and lawful basis. Then move to the rights, accountability evidence, risk, incident, transfer, deadline, or comparison that the facts trigger.
Determine whether UK GDPR applies, how it interacts with the Data Protection Act 2018, who decides purposes and means, and which lawful basis and additional data condition apply.
Design understandable information and request handling, then apply the additional safeguards for children and significant automated decisions under the amended UK rules.
Translate legal decisions into owned controls, records, assessments, contracts, security measures, and repeatable evidence rather than treating a checklist as proof of compliance.
Separate incident containment from the Article 33 ICO threshold, the Article 34 individual-notice threshold, operating clocks, and possible ICO remedies or fines.
Decide whether a restricted transfer exists, whether adequacy covers it, and when the IDTA, UK Addendum, risk assessment, or a narrow exception is needed.
Use comparisons to identify parallel UK and EU workstreams, not equivalence, and use the FAQ when you already know the question to resolve.
"The protection of natural persons in relation to the processing of personal data is a fundamental right"
"An Act to make provision for the regulation of the processing of information relating to individuals"
"UK GDPR guidance and resources"
Next steps
Choose one processing activity and record its scope, organisational roles, lawful basis, additional data conditions, rights, security, breach, and transfer decisions before assigning the resulting controls.
Resolve a UK GDPR scope, timing, or interpretation question against the cited source text.
Keep the activity record, decisions, supporting documents, owners, approvals, and review history together.
Review scope, roles, evidence gaps, and the next controls for a specific processing activity.