The regimes share their origin but now operate as separate laws. Test each regime against the organisation's establishments, target markets, monitoring, people, and data flows.
One activity can fall under both. Shared controls may produce evidence for both regimes, but scope, representatives, regulators, national-law conditions, transfers, and amended UK rules require separate conclusions.
UK GDPR and EU GDPR are separate regimes. An organisation may be subject to one, both, or neither for a particular activity. Run the Article 3 test independently for the UK and the EU, identify the relevant controller or processor establishments, and check whether a non-established organisation offers goods or services to or monitors people in the relevant territory. Where both laws apply, one privacy programme can support both, but it cannot replace the separate legal analysis, representative, regulator, complaint, breach, transfer, and national-law decisions.
Side-by-side comparison
UK GDPR vs EU GDPR
Compare , representatives, regulators, transfers, domestic law, divergence, and evidence.
A controller or processor caught by Article 3(2) may need a representative established in a member state where affected people are located, subject to Article 27 exceptions.
A controller or processor caught by Article 3(2) may need a representative established in a member state where affected people are located, subject to Article 27 exceptions.
UK GDPR applies to processing in the context of a UK controller or processor establishment. It can also apply to a controller or processor outside the UK when the processing relates to offering goods or services to people in the UK or monitoring their behaviour there. EU GDPR applies the corresponding tests for an establishment in the Union or for offering goods or services to or monitoring people in the Union.
A corporate group's office location, customer residence, server location, and contracting entity are relevant facts but none is a complete answer alone. Map the legal entity making each decision, the establishment whose activities are connected to the processing, the people targeted, the monitored behaviour, and the processor chain.
Write one UK Article 3 conclusion and one EU Article 3 conclusion for each material processing activity.
If Article 3(2) applies without an establishment, check the separate Article 27 representative requirement and its exceptions in each regime.
Identify the controller, joint controller, processor, and establishment for each side; do not assign scope only at group level.
Reassess when the organisation enters a new market, changes targeting or monitoring, moves decision-making, or changes contracting entities.
Sets EU territorial scope and the Union representative rule.
2
Section 2
Separate the jurisdiction-specific decisions
The ICO supervises UK GDPR. EU GDPR supervision belongs to member-state supervisory authorities, with the cooperation and consistency mechanisms and one-stop-shop rules available only when their conditions are met. The ICO cannot be an EU lead supervisory authority, and an EU lead authority does not replace the ICO for UK processing.
Transfer direction also matters. A restricted transfer from the UK uses the UK framework, including UK approval regulations, the IDTA or UK Addendum where appropriate, or another UK route. A restricted transfer from the EEA uses EU Chapter V. The European Commission renewed the UK's adequacy status in December 2025, so transfers from the EEA to the UK within that decision's scope do not need an additional Article 46 safeguard.
Maintain separate UK and EU regulator contacts, representative details, complaint routes, and breach-submission decisions.
Map each export direction and identify the applicable adequacy decision, contractual clauses, assessment, and derogation.
Apply relevant UK legislation or EU member-state law where the GDPR leaves room for domestic rules, including employment, health, research, journalism, and children's consent.
Use the current text for each regime; a UK amendment does not amend EU GDPR.
Lists the December 2025 renewal of the UK adequacy decisions and explains the effect of adequacy.
Recommended next step
Map UK and EU scope before reusing controls
Record separate scope, role, representative, regulator, national-law, and transfer conclusions, then link the evidence that genuinely serves both regimes.