The regimes share their origin but now operate as separate laws. Test each regime against the organisation's establishments, target markets, monitoring, people, and data flows.
One activity can fall under both. Shared controls may produce evidence for both regimes, but scope, representatives, regulators, national-law conditions, transfers, and amended UK rules require separate conclusions.
Structured answer sets in this page tree.
Cited legal and guidance references.
UK GDPR and EU GDPR are separate regimes. An organisation may be subject to one, both, or neither for a particular activity. Run the Article 3 test independently for the UK and the EU, identify the relevant controller or processor establishments, and check whether a non-established organisation offers goods or services to or monitors people in the relevant territory. Where both laws apply, one privacy programme can support both, but it cannot replace the separate legal analysis, representative, regulator, complaint, breach, transfer, and national-law decisions.
Compare , representatives, regulators, transfers, domestic law, divergence, and evidence.
The UK regime supervised by the ICO and supplemented by the Data Protection Act 2018.
The EU regime supervised by member-state authorities and supplemented by applicable Union and member-state law.
| Dimension | UK GDPR | EU GDPR | Operational implication |
|---|---|---|---|
| Territorial scope | Applies to processing in the context of a UK establishment and to specified offering or monitoring by organisations outside the UK. | Applies to processing in the context of an establishment in the Union and to specified offering or monitoring by organisations outside the Union. | Run both tests on the actual processing; UK scope does not establish EU scope or the reverse. |
| Representatives | A controller or processor caught by Article 3(2) may need a representative established in the UK, subject to Article 27 exceptions. | A controller or processor caught by Article 3(2) may need a representative established in a member state where affected people are located, subject to Article 27 exceptions. | When both rules apply, one representative does not automatically satisfy both appointments. |
| Regulators and lead authority | The ICO supervises UK GDPR. UK GDPR does not use the EU one-stop-shop to make the ICO an EU lead authority. | Member-state authorities supervise EU GDPR; lead and concerned authority arrangements depend on the EU cross-border-processing rules. | Keep separate regulator and breach routes even when one incident affects both territories. |
| International transfers | UK exports use UK approval regulations, UK appropriate safeguards such as the IDTA or Addendum, or another UK route. | EEA exports use EU adequacy decisions, EU SCCs, binding corporate rules, or another EU Chapter V route. | Classify each export direction. The renewed EU adequacy decision covers qualifying EEA-to-UK transfers, not every transfer in the opposite direction. |
| Domestic law | The Data Protection Act 2018 supplies UK conditions, exemptions, enforcement procedure, and separate processing regimes. | EU GDPR leaves specified matters to Union or member-state law, so the applicable national rules can differ across member states. | A shared GDPR label is not enough for employment, health, research, journalism, public-interest, or children's-data decisions. |
| Current legal text | Includes UK amendments, including the Data (Use and Access) Act 2025 changes that commenced on different dates. | Retains the EU regulation text unless amended through EU law; UK legislation does not change it. | Version-control the legal basis for each control instead of assuming matching article numbers still produce matching answers. |
| Evidence and reuse | Keep the UK scope, role, lawful-basis, rights, regulator, transfer, and domestic-law records. | Keep the corresponding EU records and the member-state analysis where relevant. | Link shared notices, inventories, security controls, and assessments only after recording why they satisfy both current requirements. |
Applies to processing in the context of a UK establishment and to specified offering or monitoring by organisations outside the UK.
Applies to processing in the context of an establishment in the Union and to specified offering or monitoring by organisations outside the Union.
Run both tests on the actual processing; UK scope does not establish EU scope or the reverse.
A controller or processor caught by Article 3(2) may need a representative established in the UK, subject to Article 27 exceptions.
A controller or processor caught by Article 3(2) may need a representative established in a member state where affected people are located, subject to Article 27 exceptions.
When both rules apply, one representative does not automatically satisfy both appointments.
The ICO supervises UK GDPR. UK GDPR does not use the EU one-stop-shop to make the ICO an EU lead authority.
Member-state authorities supervise EU GDPR; lead and concerned authority arrangements depend on the EU cross-border-processing rules.
Keep separate regulator and breach routes even when one incident affects both territories.
UK exports use UK approval regulations, UK appropriate safeguards such as the IDTA or Addendum, or another UK route.
EEA exports use EU adequacy decisions, EU SCCs, binding corporate rules, or another EU Chapter V route.
Classify each export direction. The renewed EU adequacy decision covers qualifying EEA-to-UK transfers, not every transfer in the opposite direction.
The Data Protection Act 2018 supplies UK conditions, exemptions, enforcement procedure, and separate processing regimes.
EU GDPR leaves specified matters to Union or member-state law, so the applicable national rules can differ across member states.
A shared GDPR label is not enough for employment, health, research, journalism, public-interest, or children's-data decisions.
Includes UK amendments, including the Data (Use and Access) Act 2025 changes that commenced on different dates.
Retains the EU regulation text unless amended through EU law; UK legislation does not change it.
Version-control the legal basis for each control instead of assuming matching article numbers still produce matching answers.
Keep the UK scope, role, lawful-basis, rights, regulator, transfer, and domestic-law records.
Keep the corresponding EU records and the member-state analysis where relevant.
Link shared notices, inventories, security controls, and assessments only after recording why they satisfy both current requirements.
UK GDPR applies to processing in the context of a UK controller or processor establishment. It can also apply to a controller or processor outside the UK when the processing relates to offering goods or services to people in the UK or monitoring their behaviour there. EU GDPR applies the corresponding tests for an establishment in the Union or for offering goods or services to or monitoring people in the Union.
A corporate group's office location, customer residence, server location, and contracting entity are relevant facts but none is a complete answer alone. Map the legal entity making each decision, the establishment whose activities are connected to the processing, the people targeted, the monitored behaviour, and the processor chain.
The ICO supervises UK GDPR. EU GDPR supervision belongs to member-state supervisory authorities, with the cooperation and consistency mechanisms and one-stop-shop rules available only when their conditions are met. The ICO cannot be an EU lead supervisory authority, and an EU lead authority does not replace the ICO for UK processing.
Transfer direction also matters. A restricted transfer from the UK uses the UK framework, including UK approval regulations, the IDTA or UK Addendum where appropriate, or another UK route. A restricted transfer from the EEA uses EU Chapter V. The European Commission renewed the UK's adequacy status in December 2025, so transfers from the EEA to the UK within that decision's scope do not need an additional Article 46 safeguard.
Record separate scope, role, representative, regulator, national-law, and transfer conclusions, then link the evidence that genuinely serves both regimes.
Turn the UK and EU analysis into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.