The UK’s departure from the European Union introduced a new layer of complexity to data protection. While the core principles of the General Data Protection Regulation (GDPR) remained largely intact, the UK now operates under its own domestic version, the UK GDPR. This legislation works alongside the Data Protection Act 2018 (DPA 2018). For businesses operating in the UK, freelancers, and privacy-conscious individuals, understanding the nuances between our UK GDPR and EU GDPR is crucial. It ensures continued compliance and protects personal data.
Many assume that if they complied with EU GDPR before Brexit, they automatically comply with the British data protection rules. While there are many similarities, there are also key differences and ongoing considerations. These require careful attention. This article will explain these nuances. We’ll clarify the continued compliance obligations for UK entities. Our aim is to demystify data protection post-Brexit. We’ll help you navigate your responsibilities with confidence.
From EU to UK GDPR: The Evolution of Data Protection
When the UK left the EU on 31 January 2020, and the transition period ended on 31 December 2020, the EU GDPR ceased to apply directly in the UK. To ensure continuity in data protection standards, the EU GDPR was ‘retained’ in UK law. It became the UK GDPR. This means the fundamental principles, rights, and obligations remain largely the same.
However, our domestic GDPR allows for specific modifications. These adapt the law to the UK’s unique context. The Information Commissioner’s Office (ICO) remains the independent supervisory authority for data protection in the UK. They oversee and enforce the UK GDPR and the DPA 2018.
Key Differences: UK GDPR and EU Data Protection Laws
While the spirit of data protection is shared, several key distinctions have emerged between UK GDPR and EU GDPR:
1. Jurisdiction and Data Protection Scope
- EU GDPR: Applies to organisations based in the EU. It also applies to organisations outside the EU that process personal data of individuals located in the EU (the “extra-territorial” scope).
- UK GDPR: Applies to organisations based in the UK. It also applies to organisations outside the UK that process personal data of individuals located in the UK.
Dual Compliance: If a UK business offers goods or services to, or monitors the behaviour of, individuals in the EU, then both the UK GDPR and EU GDPR apply. This creates a “dual compliance” challenge. You must satisfy both sets of regulations.
2. Data Protection Supervisory Authorities
- EU GDPR: Each EU Member State has one or more supervisory authorities. For businesses operating across multiple EU countries, the “One-Stop-Shop” (OSS) mechanism allows them to deal primarily with a ‘Lead Supervisory Authority’ in their main establishment’s country.
- UK GDPR: The Information Commissioner’s Office (ICO) is the sole supervisory authority for the UK. The OSS mechanism no longer applies to UK-based businesses for their EU operations. This means a UK business with operations in the EU may need to engage directly with relevant EU supervisory authorities for EU-related processing.
3. International Data Transfers: Cross-Border Data Flows
This is arguably the most significant area of divergence.
- EU GDPR: To transfer personal data from the EU to a “third country” (outside the EEA), an “adequacy decision” is preferred. This means the European Commission has deemed the third country’s data protection standards “essentially equivalent” to the EU’s. If no adequacy decision exists, alternative safeguards like Standard Contractual Clauses (SCCs) are required.
- UK GDPR: The UK has its own adequacy regulations.
- Transfers from UK to EEA: Data can flow freely from the UK to the European Economic Area (EEA) countries. The UK has deemed all EEA countries ‘adequate’.
- Transfers from EU to UK: In June 2021, the European Commission adopted adequacy decisions for the UK. These enable data to flow freely from the EU to the UK. This was crucial for UK businesses. These adequacy decisions are currently set to expire on 27 June 2025, although the European Commission has proposed a six-month extension until 27 December 2025 to allow for further assessment.
- Transfers from UK to other non-EEA countries: For transfers to countries outside the EEA without a UK adequacy decision, UK businesses must use “appropriate safeguards.” The ICO has developed its own International Data Transfer Agreement (IDTA) and a UK Addendum to the EU SCCs. These are specifically for our domestic data protection rules. Businesses need to conduct a transfer risk assessment (TRA) when using these safeguards.
- UK-US Data Bridge: The UK has its own data bridge with the US. This allows certified US organisations to receive personal data from the UK without additional safeguards.
4. Fines and Penalties
The maximum fines remain stringent under the UK GDPR, mirroring the EU GDPR, but are expressed in sterling:
- Serious Violations: Up to £17.5 million or 4% of annual global turnover, whichever is higher.
- Less Severe Violations: Up to £8.7 million or 2% of annual global turnover, whichever is higher.
These financial penalties are very similar to the EU GDPR’s €20 million/4% and €10 million/2% limits.
5. Age of Consent for Online Services
- EU GDPR: Sets the digital age of consent at 16 years, though Member States can lower it to a minimum of 13.
- UK GDPR: The digital age of consent is fixed at 13 years old. This is a specific adaptation for the UK context.
6. UK Representative vs. EU Representative
- EU GDPR: Organisations outside the EU that fall under the EU GDPR’s extra-territorial scope must appoint an EU representative if they don’t have an establishment in the EU.
- UK GDPR: Similarly, organisations outside the UK processing personal data of individuals in the UK (and without a UK establishment) must appoint a UK representative. Our domestic data protection law does not require this representative to be physically located in the UK, unlike the EU GDPR.
Continued Compliance Obligations for UK Entities
For UK businesses, the core principles of data protection remain paramount. Continued compliance with the UK GDPR involves several key areas:
1. Data Mapping and Records of Processing Activities (RoPA)
You must know what personal data you hold, where it comes from, who you share it with, and why. Maintain accurate RoPAs (Article 30 records). This is crucial for demonstrating accountability to the ICO.
2. Lawful Basis for Processing – UK GDPR
Every time you process personal data, you need a valid lawful basis (e.g., consent, contract, legitimate interest). The criteria for these lawful bases are largely unchanged from the EU GDPR.
3. Data Subject Rights: Individual Privacy Powers
Individuals in the UK retain all their rights under our data privacy law. These include:
- The Right to Be Informed
- The Right of Access (Subject Access Requests – DSARs)
- The Right to Rectification
- The Right to Erasure (Right to Be Forgotten)
- The Right to Restrict Processing
- The Right to Data Portability
- The Right to Object
- Rights in relation to automated decision-making and profiling
You must have processes in place to handle these requests efficiently and within the statutory timeframes.
4. Privacy Notices and Policies
Your privacy notice must clearly explain how you process personal data under the UK GDPR. Ensure it is accessible, concise, and easy to understand. Update it to reflect any specific requirements of this legislation.
5. Data Protection Impact Assessments (DPIAs)
Conduct DPIAs for high-risk processing activities. This remains a key accountability measure under the UK’s data privacy law. The methodology for conducting a DPIA is similar to that under EU GDPR.
6. Data Breach Notification Rules UK GDPR
The requirements for reporting personal data breaches to the ICO (within 72 hours where feasible) and, in high-risk cases, to affected individuals, are essentially the same as under EU GDPR.
7. Data Protection Officers (DPOs) Under UK GDPR
The conditions for appointing a DPO remain consistent with the EU GDPR. If you are a public authority or engage in large-scale systematic monitoring or processing of special category data, you likely need a DPO.
8. Reviewing International Transfers
Regularly review all international transfers of personal data to and from your UK business. Ensure you use the correct transfer mechanisms and conduct necessary risk assessments (TRAs). Stay informed about the status of the EU-UK adequacy decision, especially as it approaches its expiry or extension date.
9. Documentation and Accountability
The UK GDPR places a strong emphasis on accountability. You must be able to demonstrate your compliance. This means maintaining comprehensive documentation of your data protection policies, procedures, and decisions.
Navigating the Dual Compliance Challenge
For UK businesses operating in both the UK and the EU, managing dual compliance can be complex. Here are some strategies:
- Identify Your Reach: Clearly map where your customers, employees, and data subjects are located. This determines which GDPR applies.
- Centralised Policies, Local Adaptations: Develop a core set of data protection policies that adhere to the highest common standard (often EU GDPR, given its strictness). Then, create specific local adaptations for UK GDPR nuances, such as age of consent or representative requirements.
- Separate Records: Consider keeping separate records of processing activities for EU and UK operations if the data flows and processing purposes significantly differ.
- Legal Advice: Seek expert legal advice if you operate across both jurisdictions, especially for complex international data transfers or cross-border complaints regarding this legislation.
Your Path to Continued UK GDPR Compliance
The post-Brexit landscape means UK businesses must be diligent in understanding and applying the UK GDPR. While it shares many similarities with its EU counterpart, overlooking the key differences, particularly concerning international data transfers and supervisory authority engagement, can lead to compliance issues. By proactively assessing your data flows, updating your policies, and ensuring your teams are well-informed, your UK business can confidently navigate the nuances of UK GDPR and continue to build trust in your approach to data protection.