UK Data Protection Act vs GDPR Explained: Key Differences for 2026

Since Brexit, UK organisations have been navigating two parallel data protection frameworks: the UK Data Protection Act 2018 (DPA 2018) and the UK GDPR, which sits alongside the original EU GDPR. For businesses operating across borders, understanding the differences, overlaps, and practical compliance obligations has never been more important.

This guide breaks down the UK Data Protection Act vs GDPR debate in plain English, covering legal scope, enforcement, individual rights, and what UK organisations need to do in 2026 to stay compliant.

What Is the UK Data Protection Act 2018?

The UK Data Protection Act 2018 (DPA 2018) is the UK's primary data protection legislation. It replaced the Data Protection Act 1998 and was designed to sit alongside the EU GDPR, which the UK was still part of at the time of its enactment.

The DPA 2018 does three main things:

1. Supplements the UK GDPR by filling in national derogations (areas where the GDPR allows member states to set their own rules).
2. Applies data protection standards to law enforcement processing (Part 3).
3. Applies data protection standards to intelligence services (Part 4).

In short, the DPA 2018 is the UK's domestic law that tailors general data protection principles to the UK's legal and institutional context.

What Is the UK GDPR?

The UK GDPR is the retained version of the EU General Data Protection Regulation, incorporated into UK law under the European Union (Withdrawal) Act 2018 after Brexit took effect on 1 January 2021.

It mirrors the EU GDPR almost word-for-word but with amendments to make it work as domestic UK legislation. For example, references to "Member States" have been replaced with "the United Kingdom," and the Information Commissioner's Office (ICO) is designated as the sole supervisory authority.

The UK GDPR sets out the core principles of data protection, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

UK Data Protection Act vs GDPR: Core Differences

The DPA 2018 and the UK GDPR are not competing laws — they work together. However, they have distinct scopes and functions. Here's a side-by-side comparison:

Feature	UK Data Protection Act 2018	UK GDPR
Type of law	UK domestic Act of Parliament	Retained EU regulation
Primary purpose	Supplements UK GDPR; covers law enforcement and intelligence	Sets core principles for general processing
Scope	Broader — includes areas outside GDPR scope	General personal data processing
Regulator	Information Commissioner's Office (ICO)	Information Commissioner's Office (ICO)
Maximum fine	£17.5 million or 4% of global turnover	£17.5 million or 4% of global turnover
Children's age of consent	13 (set via national derogation)	Default 16, but allows national variation
Covers law enforcement?	Yes (Part 3)	No — separate Law Enforcement Directive equivalent
Covers intelligence services?	Yes (Part 4)	No

How the Two Laws Work Together

Think of the UK GDPR as the engine and the DPA 2018 as the chassis built around it. The UK GDPR sets out the main data protection framework for general processing, while the DPA 2018:

• Provides UK-specific exemptions (e.g. for journalism, national security, immigration).
• Sets the age of consent for information society services at 13 (not 16).
• Establishes the ICO's powers, duties, and enforcement regime.
• Governs processing by competent authorities for law enforcement purposes.
• Covers processing by the UK's intelligence agencies.

So when a UK business processes customer data, they need to comply with both the UK GDPR and the DPA 2018 simultaneously — not one or the other.

UK GDPR vs EU GDPR: Are They Still the Same?

For now, the UK GDPR and EU GDPR remain largely aligned. However, divergence is beginning to emerge. The Data (Use and Access) Act 2025 and the previous Data Protection and Digital Information Bill introduced UK-specific reforms designed to reduce compliance burdens while — the government hopes — preserving the EU's adequacy decision.

Key areas of divergence or potential divergence include:

1. Legitimate interests: The UK has introduced a list of "recognised legitimate interests" that don't require a balancing test.
2. Subject Access Requests (SARs): UK organisations can refuse or charge for "vexatious or excessive" requests more easily.
3. Automated decision-making: The UK has loosened some restrictions on solely automated decisions.
4. International transfers: The UK has introduced its own International Data Transfer Agreement (IDTA) and UK Addendum to the EU SCCs.
5. Cookies and PECR: The UK is moving toward an opt-out model for low-risk analytics cookies.

Organisations operating in both the UK and EU must now map their processing activities against both regimes, especially when transferring data across borders.

Individual Rights Under Both Laws

Both the UK GDPR and the DPA 2018 grant individuals ("data subjects") a strong set of rights. These rights apply to most general processing but are modified for law enforcement and intelligence contexts.

The Eight Core Rights

1. Right to be informed — about how your data is collected and used.
2. Right of access — to obtain a copy of your personal data (SAR).
3. Right to rectification — to correct inaccurate data.
4. Right to erasure — the "right to be forgotten," with exceptions.
5. Right to restrict processing — pause processing in certain circumstances.
6. Right to data portability — receive your data in a machine-readable format.
7. Right to object — including to direct marketing.
8. Rights related to automated decision-making and profiling.

Under the DPA 2018, some of these rights are limited for law enforcement processing (Part 3) and significantly restricted for intelligence services (Part 4).

Enforcement and Penalties

The Information Commissioner's Office (ICO) enforces both the UK GDPR and the DPA 2018. Penalties are tiered:

Violation Tier	Maximum Fine	Typical Breaches
Standard tier	£8.7 million or 2% of global annual turnover	Record-keeping, breach notification, data processor obligations
Higher tier	£17.5 million or 4% of global annual turnover	Breach of data protection principles, lawful basis, data subject rights, international transfer rules

In addition to fines, the ICO can issue enforcement notices, assessment notices, and even criminal prosecutions in some cases (e.g. unlawfully obtaining personal data under Section 170 of the DPA 2018).

Practical Compliance Steps for UK Businesses

Whether you're a startup or an established enterprise, aligning with both the UK GDPR and the DPA 2018 requires a structured approach. Here's a seven-step framework:

1. Map your data. Document what personal data you hold, where it came from, who you share it with, and your lawful basis for processing.
2. Update privacy notices. Ensure they comply with Article 13/14 UK GDPR transparency requirements.
3. Review your lawful bases. Especially consent, contract, and legitimate interests.
4. Secure your data. Implement appropriate technical and organisational measures, including encryption, access controls, and secure link-sharing practices.
5. Handle SARs efficiently. Build a workflow to respond within one month.
6. Prepare for breaches. You must notify the ICO within 72 hours of becoming aware of a reportable breach.
7. Review international transfers. Use the IDTA, UK Addendum, or rely on adequacy decisions.

Even seemingly small details — like how you share links containing identifiers — can create compliance risk. If you're sharing marketing or tracking URLs, using a privacy-focused shortener such as Lunyb can help minimise exposure of raw tracking parameters and give you cleaner, auditable links. For a wider comparison of options, see our 2026 buyer's guide to URL shorteners.

Special Categories of Data

Both laws impose stricter rules on "special category data" — information about race, ethnicity, political opinions, religion, trade union membership, genetics, biometrics, health, sex life, or sexual orientation.

To process this data lawfully, you need:

1. A lawful basis under Article 6 of the UK GDPR, and
2. A separate condition under Article 9, and
3. In many cases, an additional condition under Schedule 1 of the DPA 2018.

The DPA 2018's Schedule 1 is where UK-specific nuance really shows up — it defines when employers, healthcare providers, insurers, and others can process sensitive data.

Children's Data: A Key UK Difference

One of the most practical differences between the UK and EU regimes concerns children's data. Under the UK GDPR and DPA 2018, children aged 13 and above can consent to information society services on their own. In most EU countries, the threshold is 16 (though some countries have set it as low as 13).

UK organisations offering online services to children must also follow the ICO's Age Appropriate Design Code (also known as the Children's Code), which sets 15 standards for designing services that children are likely to access.

International Data Transfers

Transferring personal data outside the UK requires one of the following safeguards:

• Adequacy regulations — the UK recognises the EEA, plus other jurisdictions like Japan, Canada (commercial), and the UK-US Data Bridge.
• International Data Transfer Agreement (IDTA) — the UK's own transfer contract.
• UK Addendum — attached to the EU Standard Contractual Clauses.
• Binding Corporate Rules (BCRs) — for multinational groups.
• Derogations — in limited circumstances (e.g. explicit consent, contract necessity).

A transfer risk assessment (TRA) is also required when relying on contractual mechanisms, following the Schrems II principles.

Common Compliance Mistakes to Avoid

Even well-intentioned organisations slip up. Watch out for:

• Assuming consent is always required — often, legitimate interests or contract is a better basis.
• Treating privacy policies as static documents instead of living records.
• Failing to appoint a DPO when required (public authorities, large-scale monitoring, large-scale special category processing).
• Ignoring processor obligations — if you're a processor, you have direct liabilities under Article 28.
• Over-collecting data "just in case" — this breaches the data minimisation principle.
• Forgetting the PECR rules on cookies and electronic marketing, which sit alongside UK GDPR.

Looking Ahead: The Future of UK Data Protection

The UK's data protection landscape is evolving. The Data (Use and Access) Act 2025 introduced reforms focused on reducing friction for businesses while maintaining high protection standards. Expect more guidance from the ICO on AI governance, biometric data, and research exemptions through 2026.

At the same time, the EU is reviewing the UK's adequacy decision in 2025–2026. If adequacy is lost, UK organisations transferring data from the EU will need to implement additional safeguards — a significant commercial consideration for cross-border businesses.

FAQ

Is the UK still bound by the EU GDPR after Brexit?

No. The EU GDPR no longer applies directly in the UK. However, the UK GDPR — a near-identical retained version — now applies, alongside the DPA 2018. UK organisations offering goods or services to EU residents may still fall under the EU GDPR extraterritorially.

Which law takes priority: the UK GDPR or the DPA 2018?

They operate together rather than in a hierarchy. The UK GDPR sets the core framework for general processing, while the DPA 2018 supplements it with UK-specific detail and covers areas (law enforcement, intelligence) that the UK GDPR doesn't address.

What is the maximum fine under UK data protection law?

The ICO can issue fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for serious breaches of the UK GDPR or DPA 2018.

Do I need to appoint a Data Protection Officer (DPO)?

A DPO is mandatory if you're a public authority, your core activities involve large-scale regular and systematic monitoring, or you process large volumes of special category data. Many organisations appoint a DPO voluntarily as a best practice.

How long do I have to report a personal data breach?

You must notify the ICO within 72 hours of becoming aware of a reportable breach. If the breach is likely to result in high risk to individuals, you must also notify affected data subjects without undue delay.

Final Thoughts

The UK Data Protection Act vs GDPR debate isn't really a competition — it's a partnership. The DPA 2018 tailors the UK GDPR to British legal and institutional realities, and the two laws together form the backbone of UK data protection in 2026.

For businesses, the key is to treat compliance as an ongoing process: map your data, document your decisions, keep privacy notices current, and build privacy by design into every new product, campaign, and link you share. Tools that reduce data exposure — from encrypted DNS to privacy-conscious link shorteners — all play their part in a robust compliance posture.