Use one inventory and control library, but route UK and EU representatives, regulators, rights requests, incidents, national-law decisions, and transfers through the correct jurisdiction.
The ICO is the UK regulator. EU lead-authority and arrangements apply only when the EU GDPR conditions are met and do not replace the UK route.
This comparison focuses on operating the two regimes, not cataloguing every textual difference. A shared privacy programme can maintain one data inventory, vendor register, security baseline, and evidence store. It should still tag the governing regime, legal entity, establishment, people, representative, regulator, deadline, transfer direction, and national-law condition for each workflow. The EU does not combine the EU and UK routes. The same event can require separate UK and EU decisions even when one team and one technical control handle it.
Configure the same privacy programme for separate scope, contacts, requests, incidents, transfers, and evidence.
UK scope, UK representative where required, ICO supervision, and UK transfer tools.
EU scope, EU representative where required, member-state supervision, and EU transfer tools.
| Dimension | UK route | EU route | Operational implication |
|---|---|---|---|
| Scope tag | Record the UK establishment or Article 3(2) offering or monitoring facts. Sources (1)
| Record the Union establishment or Article 3(2) offering or monitoring facts. Sources (1)
| Attach both conclusions to the activity when both regimes apply. Sources (1)
|
| Representative | Record the UK representative and its contact details when Article 27 requires one. Sources (1)
| Record the EU representative and member state when EU Article 27 requires one. Sources (1)
| Route people and regulators to the representative appointed for their regime. Sources (1)
|
| Regulator route | Route UK complaints, consultations, and notifications to the ICO where the applicable rule requires it. Sources (1)
| Identify the competent member-state authority and any valid lead or concerned authority arrangement. Sources (1)
| One incident or complaint may create both routes. Sources (1)
|
| Rights workflow | Use current UK Article 12A timing and clarification rules and the Article 15 reasonable and proportionate search rule. Sources (1)
| Use EU Articles 12 and 15 and any applicable member-state restrictions. Sources (1)
| The case system should preserve separate clocks, pauses, search rationale, exemptions, and response records. Sources (1)
|
| Breach workflow | Assess notification to the ICO under UK Articles 33 and 34 and retain the UK risk and timing record. Sources (1)
| Assess notification to the competent EU authority under EU Articles 33 and 34 and retain the EU risk and timing record. Sources (1)
| Use one incident file with distinct regulator, deadline, content, and affected-person decisions. Sources (1)
|
| Transfer workflow | For a UK restricted transfer, record the UK approval regulation, safeguard and assessment, or applicable exception. Sources (1)
| For an EEA restricted transfer, record the EU adequacy decision, Article 46 safeguard and assessment, or applicable derogation. Sources (1)
| A contract covering both directions should identify the UK and EU instruments and conclusions separately. Sources (1)
|
| Shared evidence | Link the UK conclusion to the applicable inventory, notice, contract, assessment, incident, or response record. Sources (1)
| Link the EU conclusion and any member-state analysis to the same artifact only where it satisfies the EU requirement. Sources (1)
| Reuse the artifact, not an unsupported assumption that the legal tests are identical. Sources (1)
|
Record the UK establishment or Article 3(2) offering or monitoring facts.
Sources (1)
Sets the UK scope test.
Record the Union establishment or Article 3(2) offering or monitoring facts.
Sources (1)
Sets the EU scope test.
Attach both conclusions to the activity when both regimes apply.
Sources (1)
Supports recording the independent UK conclusion.
Record the UK representative and its contact details when Article 27 requires one.
Sources (1)
Sets the UK representative rule.
Record the EU representative and member state when EU Article 27 requires one.
Sources (1)
Sets the EU representative rule.
Route people and regulators to the representative appointed for their regime.
Sources (1)
Requires the representative to be addressed alongside or instead of the controller or processor.
Route UK complaints, consultations, and notifications to the ICO where the applicable rule requires it.
Sources (1)
Sets UK supervisory functions.
Identify the competent member-state authority and any valid lead or concerned authority arrangement.
Sources (1)
Sets EU competence, lead authority, cooperation, and consistency.
One incident or complaint may create both routes.
Sources (1)
Makes lead-authority competence conditional.
Use current UK Article 12A timing and clarification rules and the Article 15 reasonable and proportionate search rule.
Sources (1)
Sets current UK request timing, clarification, and search rules.
Use EU Articles 12 and 15 and any applicable member-state restrictions.
Sources (1)
Sets the EU request and access rules.
The case system should preserve separate clocks, pauses, search rationale, exemptions, and response records.
Sources (1)
Supports jurisdiction-specific request timing records.
Assess notification to the ICO under UK Articles 33 and 34 and retain the UK risk and timing record.
Sources (1)
Sets UK breach notification and communication duties.
Assess notification to the competent EU authority under EU Articles 33 and 34 and retain the EU risk and timing record.
Sources (1)
Sets EU breach notification and communication duties.
Use one incident file with distinct regulator, deadline, content, and affected-person decisions.
Sources (1)
Requires records of breach facts, effects, and remedial action.
For a UK restricted transfer, record the UK approval regulation, safeguard and assessment, or applicable exception.
Sources (1)
Explains current UK transfer routing.
For an EEA restricted transfer, record the EU adequacy decision, Article 46 safeguard and assessment, or applicable derogation.
Sources (1)
Sets EU transfer routing.
A contract covering both directions should identify the UK and EU instruments and conclusions separately.
Sources (1)
Provides the current EU adequacy list, including the UK.
Link the UK conclusion to the applicable inventory, notice, contract, assessment, incident, or response record.
Sources (1)
Establishes UK accountability.
Link the EU conclusion and any member-state analysis to the same artifact only where it satisfies the EU requirement.
Sources (1)
Establishes EU accountability.
Reuse the artifact, not an unsupported assumption that the legal tests are identical.
Sources (1)
Supports evidence linked to the applicable conclusion.
Sources (2)
Supports the UK operating route.
Supports the EU operating route.
Tag processing activities by controller and processor entity, relevant establishment, target population, and UK or EU scope conclusion. Connect each privacy notice, request channel, DPIA, processor contract, retention rule, incident record, and transfer agreement to those tags rather than treating the corporate group as one controller.
Appoint separate UK and EU representatives when both Article 27 duties apply. Publish the correct contact details and give each representative access to the records needed for its jurisdiction. A DPO can support both regimes, but that does not merge the representative or supervisory-authority roles.
Sources (2)
Sets UK roles, records, representatives, DPO, rights, incidents, and regulator duties.
Sets the corresponding EU roles and the cooperation and one-stop-shop conditions.
For a rights request, identify every controller and regime before calculating the response period, requesting clarification, searching, applying an exemption, or sending the response. Current UK Article 12A and Article 15 wording differs from EU Articles 12 and 15, so a shared case-management system needs jurisdiction-specific rules.
For an incident, assess UK and EU breach duties independently. Both regimes use a 72-hour supervisory-notification period where notification is required, but the recipient authority, risk analysis, content, delay explanation, and affected-controller duties must be recorded for each route. For a transfer, classify the exporter and direction before choosing adequacy, contractual clauses, or another safeguard.
The European Commission renewed the UK's GDPR adequacy decision on 19 December 2025. An EEA-to-UK transfer within that decision's scope does not need an additional EU Article 46 safeguard. The decision does not govern the opposite direction: a UK export still needs the applicable UK approval regulation, safeguard or exception.
Sources (3)
Sets the current UK request, breach, communication, and transfer rules.
Sets the corresponding EU request, breach, communication, and transfer rules.
Lists the 19 December 2025 renewal of the UK GDPR adequacy decision and explains the effect of an adequacy decision on EEA exports.
Assign UK and EU scope, representative, regulator, request, incident, national-law, and transfer fields to each operational record.
Turn jurisdiction routing into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.