GDPR After Brexit: What Changed for UK Businesses

When the United Kingdom formally left the European Union, one of the most pressing questions for businesses, marketers, and data controllers was deceptively simple: what happens to our data protection obligations? The General Data Protection Regulation (GDPR) had become the gold standard for privacy law across Europe, and British organisations had spent years and significant budgets preparing for it. Would all of that work still apply? Would UK businesses face a brand new regime? And what about the data flowing between London and Lisbon, Manchester and Munich?

The short answer is that GDPR did not disappear in the UK, but it did evolve. This guide explains exactly what changed after Brexit, what stayed the same, and what UK organisations need to know in 2026 to remain compliant on both sides of the Channel.

What Is UK GDPR?

UK GDPR is the United Kingdom's domestic version of the European Union's General Data Protection Regulation, retained in British law after Brexit and sitting alongside the amended Data Protection Act 2018. In practical terms, it mirrors the EU GDPR almost word for word, with adjustments to make it function as a standalone UK statute.

When the Brexit transition period ended on 31 December 2020, the EU GDPR ceased to apply directly in the UK. However, under the European Union (Withdrawal) Act 2018, it was "retained" in domestic law and rebranded as the UK GDPR. The Information Commissioner's Office (ICO) remains the lead supervisory authority, and the core principles — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability — all carry over unchanged.

Why Two Regimes Now Exist

UK businesses that handle personal data of individuals in both the UK and the EU must now consider two parallel regimes:

1. UK GDPR — governs the processing of personal data of individuals in the UK.
2. EU GDPR — continues to apply extraterritorially to UK organisations that offer goods or services to, or monitor the behaviour of, individuals in the European Economic Area (EEA).

This dual-regime reality is the single most important change for compliance teams to understand.

Key Differences Between UK GDPR and EU GDPR

While the two regimes are substantially similar, several practical and legal differences have emerged since Brexit. The table below summarises the most important distinctions.

Area	UK GDPR	EU GDPR
Supervisory Authority	Information Commissioner's Office (ICO)	National Data Protection Authorities (e.g. CNIL, BfDI)
Maximum Fine	£17.5 million or 4% of global turnover	€20 million or 4% of global turnover
One-Stop-Shop Mechanism	Not available	Available for cross-border EU processing
Representative Required	EU/EEA controllers targeting UK must appoint UK rep	UK controllers targeting EU must appoint EU rep
International Transfers	UK IDTA or UK Addendum to EU SCCs	EU Standard Contractual Clauses (2021)
Adequacy for Each Other	EU recognised as adequate	UK recognised as adequate (under review)
Age of Digital Consent	13 years	16 years (member states may lower to 13)

Fines Converted to Pounds

The maximum administrative fine under UK GDPR was converted from euros to pounds, landing at £17.5 million or 4% of global annual turnover, whichever is higher. The ICO retains discretion over enforcement, and recent cases suggest it is willing to issue substantial penalties where organisations have failed to protect personal data adequately.

No More One-Stop Shop

Before Brexit, UK organisations operating across the EU could deal with a single "lead supervisory authority" under the one-stop-shop mechanism. That benefit is gone. A UK company processing data in several EU member states may now have to deal with multiple national regulators simultaneously, in addition to the ICO at home.

Data Transfers Between the UK and EU

Cross-border data flows are the lifeblood of modern commerce, and this is where Brexit created the most anxiety. Fortunately, the European Commission issued two adequacy decisions in June 2021, formally recognising that the UK offers an "essentially equivalent" level of data protection. This means personal data can continue to flow freely from the EU to the UK without additional safeguards such as Standard Contractual Clauses.

The Adequacy Decision Is Not Permanent

The current adequacy decision is subject to a sunset clause and is scheduled for review. If the EU decides the UK has diverged too far from EU data protection standards — perhaps through new legislation such as the Data (Use and Access) Act — adequacy could be withdrawn. Businesses should monitor developments closely and have contingency plans involving the EU Standard Contractual Clauses ready to deploy.

Transfers From the UK to Third Countries

For transfers out of the UK to countries outside the EEA, the ICO has issued its own tools:

1. International Data Transfer Agreement (IDTA) — a standalone UK contract.
2. UK Addendum to the EU SCCs — allows organisations to append UK-specific terms to the EU's 2021 clauses, reducing paperwork for international groups.
3. Transfer Risk Assessments (TRAs) — required to document that the destination country offers adequate protection in practice.

Appointing Representatives: UK and EU

Article 27 of both regimes requires non-UK/EU controllers that offer goods or services to, or monitor the behaviour of, individuals in the respective territory to appoint a local representative in writing.

When a UK Business Needs an EU Representative

A UK-based company must appoint an EU representative if it processes personal data of individuals in the EEA in connection with:

• Offering goods or services (even for free) to EEA residents.
• Monitoring the behaviour of EEA residents, such as through analytics or targeted advertising.

Exemptions apply for occasional processing that does not involve special category data on a large scale, but most e-commerce, SaaS, and online media businesses will fall within scope.

When an EU Business Needs a UK Representative

Mirror rules apply in reverse. An EU company serving UK consumers or tracking UK users must appoint a UK representative under UK GDPR, unless the processing is genuinely occasional and low risk.

Practical Compliance Checklist for UK Businesses

If your organisation has not reviewed its data protection posture since Brexit, now is the time. Here is a prioritised checklist to work through:

1. Update your privacy notice. Reference the UK GDPR and Data Protection Act 2018, not just "the GDPR." If you serve EU users, mention the EU GDPR separately.
2. Review your records of processing activities (ROPA). Map data flows and identify any transfers to or from the EEA.
3. Check your international transfer mechanisms. Replace outdated 2010 EU SCCs with the IDTA or UK Addendum.
4. Appoint representatives where required. Document the appointment and publish contact details in your privacy notice.
5. Reassess your lead supervisory authority. If you lost the one-stop-shop benefit, decide how you will engage with multiple EU regulators.
6. Train your staff. Ensure employees understand that two regimes may apply simultaneously.
7. Monitor adequacy status. Subscribe to ICO and European Data Protection Board updates.
8. Review marketing and cookie practices. PECR still applies in the UK, and the ePrivacy Directive still applies in the EU.

Marketing, Links, and Tracking Under UK GDPR

For digital marketers, GDPR after Brexit still means obtaining valid consent for non-essential cookies, respecting the right to object to profiling, and being transparent about tracking. If you shorten URLs for campaigns, newsletters, or social posts, you should choose a provider that handles click data responsibly and offers clear data processing terms.

A privacy-conscious link management platform such as Lunyb can help by giving you control over how click analytics are collected and stored, which is particularly useful when you need to document lawful bases and data retention periods under both UK and EU regimes. For a wider comparison of what to look for, see our 2026 buyer's guide to URL shorteners.

Cookies and PECR

The Privacy and Electronic Communications Regulations (PECR) sit alongside UK GDPR and govern cookies, electronic marketing, and traffic data. PECR was not fundamentally changed by Brexit, but the ICO has sharpened its guidance, particularly around "consent or pay" models, dark patterns in consent banners, and the use of analytics cookies without consent.

Enforcement Trends Since Brexit

The ICO has demonstrated that it is willing to act independently of its EU counterparts. Notable enforcement themes since 2021 include:

• Children's privacy — robust enforcement of the Age Appropriate Design Code.
• Nuisance marketing — multi-million pound fines for unsolicited calls and texts under PECR.
• Data breaches — significant penalties where basic security hygiene was lacking.
• Public sector transparency — reprimands and enforcement notices rather than fines, reflecting the ICO's revised approach to public bodies.

The Data (Use and Access) Act and Future Reform

The UK Government has signalled an appetite for divergence through reform packages designed to reduce compliance burdens and encourage innovation in AI and data-driven industries. While wholesale repeal of UK GDPR is off the table, targeted changes to areas such as legitimate interests, automated decision-making, and research exemptions are being implemented. Each change must be weighed carefully against the risk of jeopardising EU adequacy.

What Has Not Changed

It is worth emphasising how much of GDPR survived Brexit intact. Data subject rights — access, rectification, erasure, portability, objection, and restriction — all continue to apply. The 72-hour breach notification rule, the obligation to conduct Data Protection Impact Assessments for high-risk processing, the requirement to appoint a Data Protection Officer in certain circumstances, and the principle of accountability all remain central features of the UK regime.

For most organisations, the day-to-day practice of data protection looks remarkably similar to what it did in 2019. What has changed is the paperwork, the contractual plumbing, and the number of regulators you may need to answer to.

Frequently Asked Questions

Does GDPR still apply in the UK after Brexit?

Yes. The UK retained GDPR in domestic law as the UK GDPR, which sits alongside the Data Protection Act 2018. The EU GDPR also continues to apply to UK organisations that offer goods or services to, or monitor the behaviour of, individuals in the EEA.

Can personal data still flow freely between the UK and the EU?

For now, yes. The European Commission issued an adequacy decision in June 2021 recognising the UK's data protection framework as essentially equivalent to the EU's. This allows unrestricted transfers from the EEA to the UK, but the decision is subject to periodic review and could be withdrawn if the UK diverges significantly.

Do UK businesses need to appoint an EU representative?

If a UK business offers goods or services to, or monitors the behaviour of, individuals in the EEA, it must appoint an EU representative under Article 27 of the EU GDPR, unless the processing is occasional, low risk, and does not involve special category or criminal data on a large scale.

What is the maximum fine under UK GDPR?

The maximum administrative fine under UK GDPR is £17.5 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher. This mirrors the EU GDPR structure but is denominated in pounds sterling.

What should UK businesses do about international data transfers?

For transfers out of the UK to countries without an adequacy decision, use the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Conduct a Transfer Risk Assessment to document that the destination offers adequate protection in practice, and keep contracts under review as both UK and EU guidance evolves.