UK Data Protection Act vs GDPR Explained: Key Differences for 2026

Since Brexit, UK organisations have had to navigate two overlapping privacy regimes: the UK Data Protection Act 2018 (DPA 2018) and the UK GDPR, alongside the original EU GDPR where European data is involved. The frameworks look nearly identical on the surface, but the differences matter — especially for enforcement, international data transfers, and the exemptions that apply to specific sectors.

This guide explains the UK Data Protection Act vs GDPR in plain English, highlights what changed after Brexit, and shows UK businesses what they need to do in 2026 to stay compliant with both regimes.

What Is the UK Data Protection Act 2018?

The UK Data Protection Act 2018 is the primary piece of UK legislation governing how personal data is processed. It replaced the Data Protection Act 1998 and was designed to sit alongside the EU General Data Protection Regulation (GDPR) while adding UK-specific provisions, exemptions, and law enforcement rules.

The DPA 2018 is organised into several parts:

Part 1 & 2: General processing — mirroring and supplementing the GDPR.
Part 3: Law enforcement processing (for police and criminal justice bodies).
Part 4: Intelligence services processing (MI5, MI6, GCHQ).
Part 5 & 6: Powers of the Information Commissioner's Office (ICO) and enforcement.

Crucially, the DPA 2018 does not stand alone — it works together with the UK GDPR to form the full UK data protection framework.

What Is the GDPR (EU and UK Versions)?

The General Data Protection Regulation (GDPR) is an EU regulation that came into force on 25 May 2018. It harmonised data protection law across EU member states and set a global benchmark for privacy rights, including the right to access, erase, and port personal data.

After the UK left the EU, the government incorporated the GDPR into domestic law as the UK GDPR, which took effect on 1 January 2021. The UK GDPR is almost identical to the EU GDPR in substance, but it is now a separate instrument that can be amended by Parliament independently of Brussels.

Three regimes UK businesses may deal with

UK GDPR — applies to processing personal data of individuals in the UK.
DPA 2018 — supplements the UK GDPR and covers areas it does not (e.g. law enforcement).
EU GDPR — still applies if you offer goods or services to, or monitor, individuals in the EU.

UK Data Protection Act vs GDPR: Side-by-Side Comparison

Here is a direct comparison of the two frameworks as they apply in the UK today.

Feature	UK Data Protection Act 2018	UK GDPR
Legal type	Act of Parliament (domestic law)	Retained EU regulation, now UK statute
Primary role	Supplements UK GDPR; adds UK-specific rules	Sets core data protection principles and rights
Scope	All processing in the UK, including law enforcement and intelligence	General processing of personal data of UK residents
Regulator	Information Commissioner's Office (ICO)	Information Commissioner's Office (ICO)
Maximum fine	£17.5m or 4% of global turnover	£17.5m or 4% of global turnover
Children's age of consent	13 (set by DPA 2018)	Default 16 in EU GDPR; UK sets it to 13
Exemptions	Journalism, research, national security, immigration	Framework rights only — exemptions defined by DPA
International transfers	UK adequacy decisions, UK IDTA, UK BCRs	Governed under UK GDPR Chapter V

Key Differences Between the DPA 2018 and GDPR

While the two frameworks are deeply intertwined, several meaningful differences exist. Understanding them helps you work out which rules apply when.

1. One sets the principles, the other fills in the gaps

The UK GDPR sets the core principles — lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity, and accountability. The DPA 2018 adds the "missing pieces" the GDPR leaves to member states, such as the age of consent, exemptions, and rules for sensitive processing.

2. Scope of application

The UK GDPR applies to general commercial and public-sector processing. The DPA 2018 goes further, covering areas the GDPR does not — most notably law enforcement processing (Part 3) and intelligence services processing (Part 4). If you run a marketing agency, Part 2 is what you care about; if you process criminal data for a police force, Part 3 governs you.

3. Children's age of consent

Under the EU GDPR, the default digital age of consent is 16, but member states can lower it. The UK, via the DPA 2018, has set the age at 13. This affects any online service that relies on consent as its lawful basis for processing children's data.

4. Exemptions and derogations

The DPA 2018 contains detailed exemptions that modify how rights apply in specific contexts, including:

Journalism, academia, art and literature (Schedule 2)
Research and statistics
National security and defence
Immigration control
Legal professional privilege

These exemptions do not exist in the GDPR itself — they are a UK choice.

5. International data transfers

Since Brexit, the UK operates its own adequacy regime. The UK has recognised the EEA as adequate, meaning data can flow freely from the UK to the EU. The EU has (so far) returned the favour. However, for transfers outside these zones, UK organisations must use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — not the EU SCCs on their own.

What Changed After Brexit?

On 1 January 2021, the EU GDPR stopped applying directly in the UK. Instead:

The UK GDPR came into force as domestic legislation.
The DPA 2018 was amended to reference the UK GDPR instead of the EU GDPR.
The UK established its own system for adequacy decisions and transfer mechanisms.
UK organisations offering services to EU residents still need to comply with the EU GDPR and may need to appoint an EU representative.

In mid-2025, the UK also passed the Data (Use and Access) Act, which makes targeted reforms to the UK data protection regime — simplifying some obligations around cookies, legitimate interests, and automated decision-making while keeping the overall UK GDPR structure intact. For most SMEs, the day-to-day compliance picture remains very similar to 2018.

Rights of Individuals Under Both Frameworks

Both the UK GDPR and the DPA 2018 give individuals ("data subjects") a core set of rights:

Right to be informed — via privacy notices.
Right of access — the Subject Access Request (SAR).
Right to rectification — correct inaccurate data.
Right to erasure — the "right to be forgotten".
Right to restrict processing.
Right to data portability.
Right to object — including to direct marketing.
Rights related to automated decision-making and profiling.

The DPA 2018 can modify how these rights apply — for example, journalism exemptions can limit the right of access in investigative reporting.

Penalties and Enforcement

The ICO enforces both the UK GDPR and the DPA 2018. The maximum fines are aligned:

Standard maximum: £8.7 million or 2% of global annual turnover (whichever is higher).
Higher maximum: £17.5 million or 4% of global annual turnover (whichever is higher).

The ICO can also issue enforcement notices, assessment notices, and in some cases pursue criminal prosecution — for example, for unlawfully obtaining personal data under section 170 of the DPA 2018.

Compliance Checklist for UK Businesses in 2026

If you process personal data in the UK, use this practical checklist as a starting point:

Map your data. Know what personal data you hold, where it came from, who you share it with, and how long you keep it.
Identify your lawful basis. Document a lawful basis under Article 6 (and Article 9 for special category data) for every processing activity.
Update your privacy notice. Make sure it reflects UK GDPR language and references the ICO as the regulator.
Review contracts. Ensure data processing agreements with suppliers include UK GDPR Article 28 clauses.
Check international transfers. Use the UK IDTA or Addendum where needed and run transfer risk assessments.
Train staff. Everyone handling personal data should understand breach reporting and SAR handling.
Have a breach plan. Serious breaches must be reported to the ICO within 72 hours.
Appoint a DPO if required. Mandatory for public authorities and large-scale sensitive processing.

Where Everyday Tools Fit In

Compliance isn't only about policies — it's also about the tools you use day to day. Marketing links, analytics tags, cookie banners, and tracking pixels all count as processing personal data when they capture identifiers like IP addresses or device fingerprints.

For example, when sharing campaign links, choosing a URL shortener that offers transparent analytics and avoids excessive third-party tracking can reduce your compliance footprint. We cover this in detail in our 2026 buyer's guide to URL shorteners, and privacy-conscious options like Lunyb are designed to collect only the minimum data needed to show you useful statistics. If you've been comparing enterprise options, our Rebrandly review also looks at how larger platforms handle data processing agreements.

Which One Applies to Your Business?

In most cases, the answer is both. If you are a UK business processing personal data of UK residents, the UK GDPR provides the main rulebook and the DPA 2018 fills in the UK-specific details and exemptions. If you also target customers in the EU, the EU GDPR applies on top.

You rarely choose between them — you comply with the combined framework. The key is understanding how they interact, so you apply the right exemption, consent age, or transfer mechanism in each situation.

Frequently Asked Questions

Is the UK still subject to the GDPR after Brexit?

Yes, but through the UK GDPR, which is the retained version of the EU GDPR written into UK law. The EU GDPR still applies when you offer goods or services to, or monitor, people in the EU.

What is the main difference between the DPA 2018 and the UK GDPR?

The UK GDPR sets the core principles and rights. The DPA 2018 supplements it with UK-specific details — including exemptions, the age of consent (13), and rules for law enforcement and intelligence services that the GDPR doesn't cover.

What are the fines for breaching UK data protection law?

The ICO can impose fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious infringements. Lower-tier breaches can attract up to £8.7 million or 2% of turnover.

Do I need to appoint a Data Protection Officer (DPO)?

You must appoint a DPO if you are a public authority, carry out large-scale systematic monitoring, or process large volumes of special category or criminal data. Many organisations appoint one voluntarily as good practice.

Can personal data still flow between the UK and the EU?

Yes. The EU granted the UK an adequacy decision, and the UK recognises the EEA as adequate. Data can therefore flow freely in both directions, although the adequacy decision is subject to periodic review.