UK Data Protection Act vs GDPR Explained: Key Differences in 2026

Since Brexit, British businesses have had to navigate two overlapping privacy frameworks: the UK Data Protection Act 2018 (DPA 2018) and the General Data Protection Regulation (GDPR). For many organisations, the distinction feels blurry — and getting it wrong can mean fines of up to £17.5 million or 4% of global turnover. This guide breaks down exactly how these laws relate, where they diverge, and what you need to do to stay compliant in 2026.

What Is the UK Data Protection Act 2018?

The UK Data Protection Act 2018 is the primary piece of UK legislation governing how personal data is processed within the United Kingdom. It sits alongside the UK GDPR and together they form the backbone of British data protection law.

The DPA 2018 replaced the older Data Protection Act 1998 and was designed to implement the EU GDPR into domestic UK law, while also adding provisions for areas the EU regulation did not cover — such as law enforcement processing, intelligence services, and national security exemptions.

Key components of the DPA 2018

1. Part 1 – Preliminary definitions and scope.
2. Part 2 – General processing (supplements the UK GDPR).
3. Part 3 – Law enforcement processing (for police and criminal justice bodies).
4. Part 4 – Intelligence services processing.
5. Parts 5–7 – The Information Commissioner, enforcement, and supplementary provisions.

What Is the GDPR?

The General Data Protection Regulation (GDPR) is an EU-wide law that came into force on 25 May 2018. It regulates how organisations collect, store, and process the personal data of individuals in the European Economic Area (EEA).

After Brexit, the EU GDPR no longer directly applies in the UK. Instead, it was retained as part of UK law and modified to work domestically — this version is called the UK GDPR. So when people say "GDPR" in a UK context, they could mean one of two things:

• EU GDPR – Still applies to UK organisations that offer goods or services to, or monitor the behaviour of, individuals in the EEA.
• UK GDPR – Applies to the processing of personal data within the UK, working alongside the DPA 2018.

UK Data Protection Act vs GDPR: The Core Relationship

The simplest way to think about it: the UK GDPR sets the main rules, and the DPA 2018 fills in the gaps, adds UK-specific exemptions, and covers areas the GDPR doesn't. They're not competing laws — they're designed to work together.

If you're a UK-based business processing personal data about UK residents, you must comply with both the UK GDPR and the DPA 2018. If you also handle data about people in the EU, the EU GDPR applies on top.

Comparison table: DPA 2018 vs UK GDPR vs EU GDPR

Feature	DPA 2018	UK GDPR	EU GDPR
Jurisdiction	United Kingdom	United Kingdom	EEA member states
Regulator	ICO	ICO	National DPAs (e.g. CNIL, DPC)
Maximum fine	£17.5m or 4% global turnover	£17.5m or 4% global turnover	€20m or 4% global turnover
Covers law enforcement	Yes (Part 3)	No	No (separate LED directive)
Covers intelligence services	Yes (Part 4)	No	No
Age of consent for children	13	13	16 (member states can lower to 13)
International transfers	UK adequacy decisions	UK adequacy decisions	EU adequacy decisions

Key Differences Between the DPA 2018 and GDPR

While the two frameworks are highly aligned, there are meaningful differences UK organisations need to understand.

1. Scope and purpose

The GDPR focuses purely on general data processing by controllers and processors. The DPA 2018 is broader — it also governs processing by competent authorities for law enforcement purposes and by the intelligence services, areas the GDPR explicitly excludes.

2. Age of consent for online services

Under the EU GDPR, the default age at which a child can consent to online services (such as social media) is 16, though member states may lower it to 13. The DPA 2018 sets this age at 13 in the UK, matching the US COPPA threshold.

3. National security and immigration exemptions

The DPA 2018 contains broader exemptions for national security, immigration enforcement, and crime prevention than the EU GDPR allows. The controversial "immigration exemption" in Schedule 2 has been challenged in UK courts and amended, but still provides more latitude than EU law would permit.

4. International data transfers

Since Brexit, the UK makes its own adequacy decisions. The UK currently recognises the EEA as adequate, and the EU has granted the UK adequacy status (reviewed in 2025). However, the two regimes could diverge — for example, the UK has signed its own "data bridge" with the United States, operating in parallel with the EU-US Data Privacy Framework.

5. Regulator and enforcement

UK organisations deal exclusively with the Information Commissioner's Office (ICO). Under the EU GDPR, organisations with operations across multiple EU states deal with a "lead supervisory authority" through the one-stop-shop mechanism — a benefit UK businesses lost after Brexit.

The Seven Data Protection Principles (Still Shared)

Both the UK GDPR and EU GDPR enshrine the same seven principles. The DPA 2018 reinforces these for UK processing:

1. Lawfulness, fairness and transparency – Process data legally and tell people what you're doing.
2. Purpose limitation – Only use data for specified, explicit purposes.
3. Data minimisation – Collect only what you need.
4. Accuracy – Keep personal data accurate and up to date.
5. Storage limitation – Don't keep data longer than necessary.
6. Integrity and confidentiality – Secure data appropriately.
7. Accountability – Be able to demonstrate compliance.

Individual Rights Under Both Frameworks

UK residents enjoy the same eight data subject rights under both the UK GDPR and EU GDPR, reinforced by the DPA 2018:

• The right to be informed
• The right of access (subject access requests)
• The right to rectification
• The right to erasure ("right to be forgotten")
• The right to restrict processing
• The right to data portability
• The right to object
• Rights related to automated decision-making and profiling

For UK businesses that collect data through web forms, tracking links, or analytics tools, respecting these rights is essential. Even something as simple as the links you share matters — if you use a URL shortener, you're often passing click data through a third party. Privacy-respecting services like Lunyb minimise data collection, which helps reduce your compliance burden. For a broader look at how different shorteners handle privacy, see our 2026 buyer's guide to URL shorteners.

Who Needs to Comply?

Compliance obligations depend on where you're based and whose data you handle.

UK-only businesses serving UK customers

You must comply with the UK GDPR and DPA 2018. The EU GDPR does not apply unless you specifically target EU residents.

UK businesses serving EU customers

You must comply with both the UK GDPR/DPA 2018 and the EU GDPR. You'll likely also need to appoint an EU representative under Article 27 of the EU GDPR.

EU businesses serving UK customers

You're bound by the EU GDPR and also by the UK GDPR for your UK-facing activities. You may need a UK representative.

Public authorities

The DPA 2018's Part 3 (law enforcement) and Part 4 (intelligence services) apply to specific UK public bodies — these have no direct GDPR equivalent.

Enforcement and Penalties

The ICO enforces both the UK GDPR and the DPA 2018. Fines fall into two tiers:

• Standard maximum: £8.7 million or 2% of global annual turnover (whichever is higher) — for less severe infringements.
• Higher maximum: £17.5 million or 4% of global annual turnover — for serious violations like breaching the core principles or data subject rights.

Beyond fines, the ICO can issue enforcement notices, assessment notices, and even prosecute certain DPA 2018 offences (such as unlawfully obtaining personal data under Section 170).

Practical Compliance Steps for UK Businesses

Whether you're a sole trader or a large enterprise, these steps form the foundation of compliance:

1. Map your data – Document what personal data you hold, where it came from, and who you share it with.
2. Identify your lawful basis – For every processing activity, pick one of the six lawful bases (consent, contract, legal obligation, vital interests, public task, or legitimate interests).
3. Update your privacy notice – Make sure it covers everything required by UK GDPR Articles 13 and 14.
4. Review contracts with processors – Article 28 contracts are mandatory.
5. Assess international transfers – Use the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
6. Prepare for data subject requests – You have one month to respond to most requests.
7. Train your staff – Human error causes most breaches.
8. Have a breach response plan – You must notify the ICO within 72 hours of becoming aware of a reportable breach.

The Future: Data (Use and Access) Act and Divergence

The UK's data protection landscape continues to evolve. The Data (Use and Access) Act 2025 (DUAA) introduced targeted reforms to the UK GDPR and DPA 2018, including:

• Clarified rules on legitimate interests and "recognised legitimate interests."
• Simplified requirements around automated decision-making.
• Reforms to subject access request handling, including a formal "stop the clock" mechanism.
• Changes to how PECR (cookies and marketing) works.
• Restructuring the ICO into the new Information Commission.

These reforms aim to reduce compliance burdens while — crucially — maintaining the EU adequacy decision the UK needs for frictionless data flows with Europe. So far, divergence has been modest, but the gap between UK and EU rules is widening.

Common Myths About the DPA 2018 and GDPR

Myth 1: "Brexit means GDPR doesn't apply to us anymore."

False. The UK GDPR is almost identical to the EU GDPR, and if you serve EU customers, the EU version still applies.

Myth 2: "The DPA 2018 replaced GDPR in the UK."

False. They work together. The DPA 2018 supplements the UK GDPR.

Myth 3: "Small businesses are exempt."

Mostly false. Size-based exemptions are very narrow. Nearly all businesses that process personal data must comply.

Myth 4: "We only need consent for everything."

False. Consent is one of six lawful bases. For many activities (like fulfilling a contract or legitimate business interests), consent isn't appropriate.

FAQ

Is the UK GDPR the same as the EU GDPR?

Almost, but not quite. The UK GDPR is the EU GDPR as retained in UK law after Brexit, with technical amendments to make it work domestically (for example, replacing references to EU institutions with UK ones). The substantive rules and principles are nearly identical, but the UK can now diverge over time — and has started to, through the Data (Use and Access) Act 2025.

Do I need to comply with both UK and EU GDPR?

If your business is based in the UK but offers goods or services to people in the EEA, or monitors their behaviour (for example through analytics), yes — both apply. You'll also likely need to appoint an EU representative. UK-only businesses with no EU-facing activities generally only need to comply with the UK regime.

What's the maximum fine under the DPA 2018?

The higher tier maximum is £17.5 million or 4% of worldwide annual turnover, whichever is greater. The standard tier maximum is £8.7 million or 2% of turnover. These align with the UK GDPR penalty structure, as the two laws are enforced together by the ICO.

Does the DPA 2018 cover Brexit-related data transfers?

The DPA 2018 and UK GDPR together govern how personal data can be transferred out of the UK. The UK maintains its own list of "adequate" countries and uses the International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses for transfers to non-adequate countries. The EU has granted the UK adequacy status, which was renewed in 2025.

Who enforces the UK Data Protection Act?

The Information Commissioner's Office (ICO) enforces both the DPA 2018 and the UK GDPR. The ICO can issue fines, enforcement notices, audits, and in some cases pursue criminal prosecutions for specific offences such as unlawfully obtaining or disclosing personal data.

Conclusion

The UK Data Protection Act 2018 and the GDPR aren't rival frameworks — they're partners. The UK GDPR provides the overarching rules, and the DPA 2018 fills in the UK-specific details, exemptions, and regimes for policing and intelligence. For most UK businesses, compliance means treating them as a single, unified obligation under the ICO's oversight.

As the UK continues to refine its data protection regime through the DUAA and future reforms, staying informed is non-negotiable. Document your processing, respect data subject rights, and choose vendors — from analytics platforms to link management tools — that take privacy seriously.