UK Data Protection Act vs GDPR Explained: Key Differences in 2026

Since the UK left the European Union, data protection professionals have wrestled with a deceptively simple question: which law actually applies to my organisation, the UK Data Protection Act 2018 or the GDPR? The honest answer is usually "both, in different ways" — and the nuances matter, especially when fines can reach into the millions of pounds.

This guide breaks down the relationship between the UK Data Protection Act (DPA) 2018, the UK GDPR, and the EU GDPR. We'll cover what each law does, how they overlap, where they diverge, and what UK organisations need to do to stay compliant in 2026.

What Is the UK Data Protection Act 2018?

The UK Data Protection Act 2018 (DPA 2018) is the United Kingdom's primary domestic data protection legislation. It sits alongside the UK GDPR and tailors the GDPR framework to fit UK-specific needs, including national security, immigration, law enforcement, and intelligence services.

The DPA 2018 came into force on 25 May 2018, the same day the EU's General Data Protection Regulation became applicable. It replaced the older Data Protection Act 1998 and was designed to ensure UK law remained compatible with EU standards while allowing for sector-specific exemptions.

Key Functions of the DPA 2018

• Implements the GDPR framework into UK law
• Provides exemptions and derogations permitted under GDPR
• Covers processing outside the scope of EU law (e.g. national security)
• Sets rules for law enforcement processing
• Establishes the Information Commissioner's Office (ICO) powers

What Is the GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that came into force on 25 May 2018. It governs how personal data of individuals in the EU is collected, processed, stored, and shared, and applies to any organisation worldwide that handles such data.

After Brexit, the EU GDPR was incorporated into UK law as the "UK GDPR" via the European Union (Withdrawal) Act 2018. This means the UK now has its own version of the GDPR that mirrors the EU regulation but can diverge over time.

Core GDPR Principles

1. Lawfulness, fairness and transparency — processing must have a legal basis
2. Purpose limitation — data collected for specified, explicit purposes
3. Data minimisation — only collect what is necessary
4. Accuracy — keep personal data accurate and up to date
5. Storage limitation — don't keep data longer than needed
6. Integrity and confidentiality — secure data against unauthorised access
7. Accountability — controllers must demonstrate compliance

UK Data Protection Act vs GDPR: The Key Differences

The DPA 2018 and the UK GDPR are companion pieces of legislation rather than rivals. The UK GDPR sets the overarching rules; the DPA 2018 fills in the practical details and exemptions. Here's how they compare side-by-side.

Aspect	UK GDPR	DPA 2018	EU GDPR
Jurisdiction	United Kingdom	United Kingdom	European Union / EEA
Primary purpose	General data protection framework	UK-specific derogations and law enforcement processing	General data protection framework
Regulator	ICO (Information Commissioner's Office)	ICO	National DPAs (e.g. CNIL, BfDI)
Maximum fine	£17.5m or 4% of global turnover	Same as UK GDPR	€20m or 4% of global turnover
Age of consent for children	13	13	16 (varies by member state)
One-stop-shop mechanism	No	No	Yes
Adequacy decisions	Made by UK government	Made by UK government	Made by European Commission

1. Geographic Scope

The most obvious difference is jurisdictional. The UK GDPR and DPA 2018 apply to organisations established in the UK and to those targeting UK residents. The EU GDPR applies to EU/EEA establishments and to organisations offering goods or services to people in the EU.

If your business operates across the Channel — say, a London e-commerce shop selling to customers in Paris and Berlin — you'll need to comply with both the UK GDPR and the EU GDPR.

2. Regulatory Oversight

The Information Commissioner's Office (ICO) regulates UK data protection law. Under the EU GDPR, you may deal with a "lead supervisory authority" through the one-stop-shop mechanism — a benefit no longer available to UK-only businesses post-Brexit. Multi-EU operations now often need a designated EU representative.

3. International Data Transfers

Both regimes restrict transfers of personal data outside their territory unless safeguards are in place. However:

• The UK has its own list of "adequate" countries — currently mirroring the EU's but capable of diverging
• The UK uses the International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses
• The EU continues to use the 2021 Standard Contractual Clauses

4. Children's Consent

The DPA 2018 sets the age at which a child can consent to information society services at 13. The EU GDPR defaults to 16 but allows member states to lower it to 13. This matters if you operate an app or social platform targeting minors.

5. Exemptions and Derogations

The DPA 2018 contains UK-specific exemptions covering journalism, research, immigration control, and national security that aren't found in the EU GDPR. Some — such as the immigration exemption — have been challenged in UK courts.

How the Two Laws Work Together

For a typical UK business, compliance isn't a choice between the DPA 2018 and the UK GDPR — you need to follow both simultaneously. Think of it like this:

1. UK GDPR tells you what the rules are (lawful bases, rights, security obligations)
2. DPA 2018 tells you how those rules apply in the UK and provides specific exemptions
3. PECR (Privacy and Electronic Communications Regulations) sits alongside, governing cookies and marketing

If your processing falls within the scope of EU law, you'll also need to consider the EU GDPR — particularly if you're targeting EU customers or have an establishment there.

What UK Businesses Need to Do for Compliance

Whether you're a sole trader running a Shopify store or a 500-person SaaS company, the practical compliance steps are largely similar. Here's a baseline checklist for 2026.

1. Map Your Data

You can't protect what you don't know you have. Create a Record of Processing Activities (ROPA) listing every category of personal data you collect, why you collect it, where it's stored, and who it's shared with.

2. Identify a Lawful Basis

Every processing activity needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Document your reasoning.

3. Update Your Privacy Notice

Your privacy notice must clearly explain who you are, what data you collect, why, how long you keep it, and what rights individuals have. Plain English is essential — the ICO has taken action against overly complex notices.

4. Secure Your Systems

Implement appropriate technical and organisational measures: encryption in transit and at rest, access controls, regular backups, and staff training. Use trusted tools to reduce risk — for example, when sharing links or running campaigns, a privacy-conscious link platform like Lunyb can help you avoid leaking referrer data or tracking IDs to third parties. You can read more in our honest Lunyb review.

5. Handle Data Subject Requests

Individuals have rights to access, rectify, erase, restrict, port, and object to processing of their data. You generally have one calendar month to respond. Build a process before you receive your first request.

6. Report Breaches Promptly

Notifiable personal data breaches must be reported to the ICO within 72 hours of becoming aware. Maintain an internal log of all breaches, even those you don't report.

7. Review International Transfers

If you use US-based cloud services, check that your provider relies on an appropriate transfer mechanism (UK Extension to the EU-US Data Privacy Framework, IDTA, or UK Addendum). Conduct a transfer risk assessment where required.

Penalties and Enforcement

Both the UK GDPR and EU GDPR carry the same two-tier fining structure, but in different currencies:

Tier	UK GDPR / DPA 2018	EU GDPR	Typical Breaches
Standard maximum	£8.7m or 2% of global turnover	€10m or 2% of global turnover	Records, breach notification, DPO failures
Higher maximum	£17.5m or 4% of global turnover	€20m or 4% of global turnover	Principles, lawful basis, rights violations, transfers

The ICO has issued multi-million-pound fines to British Airways, Marriott, and TikTok in recent years. Beyond fines, the regulator can issue enforcement notices, audits, and warnings — and individuals can sue for compensation, including for non-material damage like distress.

The Future: Data (Use and Access) Act and Beyond

The UK government has been pursuing reform of its data protection framework. The Data (Use and Access) Act 2025 introduces changes to cookies rules, automated decision-making, and the ICO's structure, while preserving the core GDPR framework. Organisations should monitor implementation guidance from the ICO throughout 2026.

One key concern is maintaining the EU's adequacy decision for the UK, which allows the free flow of personal data from the EU to the UK. The current decision expires in 2025 and renewal depends on the UK maintaining a sufficiently equivalent level of protection.

Practical Tips for Small UK Businesses

If you're a small business owner reading this and feeling overwhelmed, the ICO actually provides excellent free resources. Focus on the basics first:

• Pay your data protection fee if you're required to (most businesses processing personal data are)
• Use a cookie banner that genuinely captures consent — not a fake one
• Keep marketing lists clean and honour opt-outs immediately
• Choose vendors carefully; you remain accountable for their processing
• Train staff annually — most breaches are human, not technical

For tools you use day-to-day, look at whether they minimise data collection by default. For instance, our 2026 URL shorteners comparison evaluates platforms on privacy posture, not just features.

Frequently Asked Questions

Is the UK still subject to GDPR after Brexit?

Yes, but through the UK GDPR — a domesticated version of the EU regulation incorporated into UK law. The EU GDPR still applies directly to UK organisations that offer goods or services to people in the EU or monitor EU residents' behaviour.

Which law takes precedence — the DPA 2018 or the UK GDPR?

Neither — they work together. The UK GDPR provides the main framework, and the DPA 2018 supplements it with UK-specific rules, exemptions, and provisions for areas outside EU competence (such as national security and law enforcement).

Do I need an EU representative if my UK business sells to EU customers?

If you're established only in the UK but offer goods or services to individuals in the EU, you generally need to appoint an Article 27 EU representative. Likewise, EU-based businesses targeting UK customers may need a UK representative.

What's the difference between the UK GDPR and the EU GDPR in practice?

The texts are nearly identical, but enforcement, regulatory bodies, fines (in £ vs €), and adequacy decisions differ. The UK can also diverge over time through reforms like the Data (Use and Access) Act 2025, so the two regimes will likely drift apart in detail.

What happens if I only comply with the EU GDPR and ignore the DPA 2018?

You'd miss UK-specific obligations like the children's consent age, certain exemptions, and law enforcement processing rules. The ICO enforces UK law, so non-compliance with the DPA 2018 and UK GDPR can result in enforcement action regardless of your EU GDPR status.

Final Thoughts

The relationship between the UK Data Protection Act 2018 and the GDPR is one of partnership rather than competition. For most UK organisations, compliance means treating the UK GDPR and DPA 2018 as a single regulatory package, while keeping an eye on the EU GDPR if you operate internationally.

The good news? If you've built a solid privacy programme on GDPR principles — lawful bases documented, rights process in place, security measures proportionate to risk — you're already most of the way there. Use 2026 as the year to refresh your records, review your vendor list, and prepare for the changes coming through the Data (Use and Access) Act.