The UK's Data (Use and Access) Act 2025 changed the UK GDPR without changing EU GDPR. The clearest operational differences now affect lawful bases, rights requests, access searches, automated decisions, and transfers.
Use the consolidated UK text and the current EU regulation for separate conclusions. Similar article numbers no longer guarantee the same rule.
Apply each regulation's territorial-scope test before comparing the rules. The and can both govern the same processing, but neither applies merely because an organisation has chosen to follow it. The UK text still shares most principles and duties with EU GDPR, while UK amendments that took effect by 5 February 2026 created material differences. The UK now has a basis tied to Annex 1, request timing and clarification rules, an express reasonable and proportionate Article 15 search limit, Articles 22A-22D for significant automated decisions, and a revised international-transfer test. These changes do not apply to processing governed only by EU GDPR. A shared control can use one operational design where that design satisfies both regimes, but the organisation should record the UK and EU scope and legal conclusions separately.
Legal-text comparison
Current UK and EU GDPR differences
Compare the rules most likely to require a branch in shared privacy controls.
Article 3 covers processing in the context of a UK establishment. It can also cover specified processing by a or outside the UK that offers goods or services to people in the UK or monitors their behaviour there.
Article 3 covers processing in the context of an establishment in the Union. It can also cover specified processing by a or outside the Union that offers goods or services to people in the Union or monitors their behaviour there.
Test each processing activity against both Article 3 provisions. The same activity may fall under one regime, both regimes, or neither, depending on the facts.
Article 6(1)(ea) applies only when processing is necessary and meets a condition in Annex 1. It is separate from ordinary legitimate interests under Article 6(1)(f).
starts the one-month period from the latest of request receipt, receipt of identity information requested under Article 12(6), and payment of a fee charged under Article 12(5). A two-month extension is available when necessary because of complexity or number, with notice and reasons due before the first month ends.
EU Article 12 requires action within one month of receiving the request. It permits a two-month extension where necessary because of complexity or number, with notice and reasons due within one month of receipt.
For Article 15, a reasonable request for information needed to identify the requested information or processing activities pauses the response period and the extension-notice period until the person replies. Entitlement is limited to results of a .
EU Articles 12 and 15 do not contain those UK clauses. Recital 63 says that, where a processes a large quantity of information about the person, it should be able to ask the person to specify the information or processing activities to which the request relates before providing the information.
Articles 22A-22D define significant solely automated decisions, restrict decisions using special-category data or , and require information, representations, human intervention, and contest safeguards for significant solely automated decisions.
Article 22 gives a person the right not to be subject to a solely automated decision producing legal or similarly significant effects, subject to stated contract, law, and explicit-consent exceptions and safeguards.
Article 46 requires the or to act reasonably and proportionately and decide whether the safeguard and any other relevant means provide protection as a whole that is not materially lower than UK protection. The circumstances include the nature and volume of the data.
EU Articles 44 and 46 require Chapter V compliance and, where Article 46 is used, appropriate safeguards, enforceable data-subject rights, and effective legal remedies. The are one Article 46 safeguard.
Keep a UK conclusion and an EU conclusion even if the factual destination analysis and supplementary measures overlap. Use an or plus the for the UK standard-clause route; EU SCCs alone do not satisfy that UK route.
Article 3 covers processing in the context of a UK establishment. It can also cover specified processing by a or outside the UK that offers goods or services to people in the UK or monitors their behaviour there.
Article 3 covers processing in the context of an establishment in the Union. It can also cover specified processing by a or outside the Union that offers goods or services to people in the Union or monitors their behaviour there.
Test each processing activity against both Article 3 provisions. The same activity may fall under one regime, both regimes, or neither, depending on the facts.
Article 6(1)(ea) applies only when processing is necessary and meets a condition in Annex 1. It is separate from ordinary legitimate interests under Article 6(1)(f).
starts the one-month period from the latest of request receipt, receipt of identity information requested under Article 12(6), and payment of a fee charged under Article 12(5). A two-month extension is available when necessary because of complexity or number, with notice and reasons due before the first month ends.
EU Article 12 requires action within one month of receiving the request. It permits a two-month extension where necessary because of complexity or number, with notice and reasons due within one month of receipt.
For Article 15, a reasonable request for information needed to identify the requested information or processing activities pauses the response period and the extension-notice period until the person replies. Entitlement is limited to results of a .
EU Articles 12 and 15 do not contain those UK clauses. Recital 63 says that, where a processes a large quantity of information about the person, it should be able to ask the person to specify the information or processing activities to which the request relates before providing the information.
Articles 22A-22D define significant solely automated decisions, restrict decisions using special-category data or , and require information, representations, human intervention, and contest safeguards for significant solely automated decisions.
Article 22 gives a person the right not to be subject to a solely automated decision producing legal or similarly significant effects, subject to stated contract, law, and explicit-consent exceptions and safeguards.
Article 46 requires the or to act reasonably and proportionately and decide whether the safeguard and any other relevant means provide protection as a whole that is not materially lower than UK protection. The circumstances include the nature and volume of the data.
EU Articles 44 and 46 require Chapter V compliance and, where Article 46 is used, appropriate safeguards, enforceable data-subject rights, and effective legal remedies. The are one Article 46 safeguard.
Keep a UK conclusion and an EU conclusion even if the factual destination analysis and supplementary measures overlap. Use an or plus the for the UK standard-clause route; EU SCCs alone do not satisfy that UK route.
Article 3 covers processing in the context of a or establishment in the United Kingdom, wherever the processing occurs. It also covers specified processing by an organisation outside the UK when the processing relates to offering goods or services to people in the UK or monitoring their behaviour there. Article 3 uses parallel tests for an establishment in the Union and for offering goods or services to, or monitoring the behaviour of, people in the Union.
Run those tests for the processing activity, not only for the organisation as a whole. For example, a UK-established that offers an online service to people in an EU Member State may need both analyses if the processing falls within both Article 3 tests. A UK-to-EU business relationship does not automatically trigger both regulations.
Identify the and any , each relevant establishment, the activity to which the processing relates, where affected people are located, and whether the service targets or monitors people in the UK or Union.
Record the facts and the Article 3 branch for each regime. Reassess when a new establishment, market, service, tracking activity, or processing purpose changes those facts.
Where both regimes apply, keep the scope analysis and the resulting obligations identifiable for each regime even if one system stores the records.
Where only one regime applies, do not describe the other regime's amended wording as the legal basis for the processing.
UK Article 6(1)(ea) permits processing necessary for a recognised legitimate interest only when an Annex 1 condition is met. The current list covers specified disclosures for public tasks, national or public security and defence, emergencies, crime, and safeguarding vulnerable individuals. This is distinct from ordinary Article 6(1)(f) legitimate interests. has no Article 6(1)(ea) or Annex 1 equivalent.
UK starts the one-month period at the latest of receiving the request, receiving information requested under Article 12(6) to confirm identity, and receiving payment of a fee charged under Article 12(5). A may extend by two further months when complexity or the number of requests makes that necessary, but it must notify the person and give reasons before the first month ends. For an Article 15 request, a reasonable request for information needed to identify the information or processing activities sought pauses both the response period and the extension-notice period until the person replies. UK Article 15 also limits entitlement to material the controller can provide through a . retains Articles 12 and 15 without those UK amendments.
Do not treat ordinary direct marketing or routine commercial interests as ; assess Article 6(1)(f) unless an Annex 1 condition actually applies.
For UK requests, record the request date, any identity information or Article 12(5) fee that sets the relevant time, the calculated deadline, any timely extension notice, any Article 15 clarification question and pause, the search locations, and the rationale.
For EU requests, use EU Articles 12 and 15 and any lawful member-state restriction; do not import the UK clock or search wording.
Keep the response substantively complete under the applicable rule even when one case-management system serves both regimes.
UK Article 22A defines a solely automated decision as one with no meaningful human involvement and a as one producing a legal or similarly significant effect. Article 22B restricts significant solely automated decisions that use special-category data and decisions relying on . Article 22C requires safeguards for every significant solely automated decision based entirely or partly on personal data, including information, representations, human intervention, and a right to contest. Article 22 instead gives a person the right not to be subject to a solely automated decision with a legal or similarly significant effect, subject to its stated exceptions and safeguards.
For a UK transfer relying on Article 46 safeguards, the or must act reasonably and proportionately and conclude that the is met. The test considers the post-transfer protection supplied as a whole by the safeguard and any other relevant means; it must not be materially lower than protection under UK data protection law. Articles 44 and 46 instead require Chapter V compliance, appropriate safeguards, enforceable data-subject rights, and effective legal remedies. The factual evidence may overlap, but a UK assessment is not the EU conclusion.
Map whether a decision is solely automated, whether it is significant, which data and lawful bases it uses, and what human involvement and safeguards are real in practice.
For a workflow subject to both regimes, test UK Articles 22A-22D and EU Article 22 separately before choosing a common design.
For each export, identify the exporter, direction, destination, transfer tool, assessment test, other or supplementary measures, outcome, owner, and review triggers such as a change in recipient, destination law, data, purpose, volume, or safeguard.
For a UK restricted transfer using standard clauses, use the or the with the UK . The EU SCCs alone are not valid for that UK purpose. If also governs the transfer, confirm that the contract package and assessment separately satisfy the EU route.