Updated 5 October 2026 · Reflects the Data (Use and Access) Act 2025 and the new Information Commission

Data Protection Act 2018 and UK GDPR: The Complete 2026 Guide for UK Businesses and Marketers

Table of Contents

How the Data Protection Act 2018 and the UK GDPR work together, what every UK business must do, what changed in 2026, and how to stay compliant when you use agencies, cookies, AI tools or offshore teams. Written in plain English, with tables you can act on.

By Chenna Reddy, Founder, Digital Masters 360 · 25-minute read · UK English

Get a free UK GDPR-ready marketing check WhatsApp +91 9505971747

The Data Protection Act 2018 and UK GDPR in 50 Words

The UK GDPR sets the core rules for handling personal data: seven principles, lawful bases, eight individual rights, security, breach reporting and fines of up to £17.5 million or 4% of turnover. The Data Protection Act 2018 sits alongside it, adding UK exemptions, special category conditions, criminal offences and the regulator’s powers.

Key takeaways

You comply with both: the UK GDPR is the main rulebook; the DPA 2018 tailors and supplements it. Neither replaces the other.
The Data (Use and Access) Act 2025 amended both laws. Most changes took effect on 5 February 2026; the duty to handle data protection complaints started on 19 June 2026.
The regulator became the Information Commission on 30 September 2026. It is still called the ICO, and its powers and fines are unchanged.
There is no small-business exemption. Most organisations pay a data protection fee of £52 or £78 a year.
Marketing is a hot spot: PECR fines now match UK GDPR levels, some analytics cookies no longer need consent, but advertising pixels still do.
The EU renewed the UK’s adequacy until 27 December 2031. Sending UK data to non-adequate countries such as India needs an IDTA or UK Addendum.

In this guide

What Are the Data Protection Act 2018 and the UK GDPR?

In the UK, data protection is governed by two instruments that are designed to be read side by side: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Together with the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and electronic marketing, they make up the UK’s data protection framework.

The UK GDPR is the EU General Data Protection Regulation (Regulation (EU) 2016/679) as it was kept in UK law after Brexit and amended to work in a UK-only context. It took effect on 1 January 2021, at the end of the Brexit transition period. It contains the principles, lawful bases, individuals’ rights, controller and processor obligations, security and breach rules, international transfer rules and the fine structure.

The Data Protection Act 2018: the UK rulebook around the rulebook

The DPA 2018 received Royal Assent on 23 May 2018 and replaced the Data Protection Act 1998. It does four jobs: it supplements the UK GDPR with UK-specific detail, sets up separate regimes for law enforcement and the intelligence services, defines the regulator’s powers, and creates criminal offences.

The DPA 2018, part by part

Part / Schedule	What it covers	Who it matters to
Part 1	Preliminary: overview and key terms	Everyone
Part 2	General processing: supplements the UK GDPR (lawful processing details, special category conditions, exemptions, age of consent of 13 for online services)	Almost every business, charity and public body
Part 3	Law enforcement processing by competent authorities (police, prosecutors), with its own six principles	Police, courts, some regulators
Part 4	Intelligence services processing	MI5, MI6, GCHQ
Part 5	The regulator: now the Information Commission	Everyone (who regulates you)
Part 6	Enforcement: notices, penalties, criminal offences, compensation; plus the complaints duty in new section 164A	Everyone
Part 7	Supplementary and final provisions, including director liability (s.198)	Directors, legal teams
Schedule 1	Conditions for special category and criminal offence data, and the ‘appropriate policy document’	HR, health, insurance, charities, marketers using sensitive data
Schedules 2–4	Exemptions (for example crime, legal professional privilege, management forecasts, journalism, research)	Anyone refusing or limiting a request

How the laws fit together

Layer	Instrument	What it does in practice
1. Core rules	UK GDPR	Principles, lawful bases, rights, obligations, transfers, fines
2. UK detail	Data Protection Act 2018	Exemptions, Schedule 1 conditions, offences, regulator powers, Parts 3–4 regimes
3. Marketing and cookies	PECR 2003	Cookies and similar technologies, marketing emails, texts and calls
4. 2025–26 reforms	Data (Use and Access) Act 2025	Amends layers 1–3: new lawful basis, SAR rules, ADM, cookie exemptions, complaints, higher PECR fines, new regulator structure

Which law do I cite?

Cite the UK GDPR for anything in the core rulebook (for example “Article 6(1)(f) UK GDPR” for legitimate interests) and the DPA 2018 for UK detail (for example “Schedule 1, Part 1, paragraph 1 DPA 2018” for employment-related special category processing).

Citation examples

Lawful basis for a newsletter list: Article 6(1)(a) UK GDPR (consent) and regulation 22 PECR.
Staff sickness records: Article 9(2)(b) UK GDPR plus Schedule 1, paragraph 1 DPA 2018.
Refusing part of a SAR to protect a crime investigation: Schedule 2, paragraph 2 DPA 2018.

Tip: use a consolidated text

Because the UK GDPR has been amended several times, read it on legislation.gov.uk in its “latest available (revised)” version, or use the government’s Keeling schedule, rather than an old PDF of the EU text.

Is the Data Protection Act 2018 the same as the UK GDPR?

No. They are two different pieces of legislation that work as one system. The UK GDPR is the main regulation; the DPA 2018 is an Act of Parliament that supplements it. Saying “we comply with the Data Protection Act 2018 and UK GDPR” is the correct, complete statement.

A short timeline of UK data protection law

Date	Milestone
1984	First Data Protection Act; Data Protection Registrar created
1998	Data Protection Act 1998 (eight principles)
25 May 2018	EU GDPR applies; Data Protection Act 2018 in force
1 Jan 2021	UK GDPR applies after the Brexit transition period
19 Jun 2025	Data (Use and Access) Act 2025 receives Royal Assent
19 Dec 2025	EU renews UK adequacy decisions until 27 December 2031
5 Feb 2026	Main DUAA data protection, PECR and transfer changes take effect
29 Apr 2026	ICO finalises its storage and access technologies (cookies) guidance
19 Jun 2026	Duty to handle data protection complaints (s.164A DPA 2018) begins
30 Sep 2026	ICO becomes the Information Commission

Key Definitions in Plain English

Most confusion about the Data Protection Act 2018 and UK GDPR comes from a handful of terms. Here they are, without the legalese.

The eight terms you need

Personal data

Any information relating to an identified or identifiable living person: names, emails, phone numbers, IP addresses, cookie IDs, device IDs, location data, CRM records, call recordings and photos. If you can single someone out, directly or indirectly, it is personal data. It applies to paper filing systems as well as electronic data.

Special category data

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation. You need an Article 6 lawful basis and an Article 9 condition, often with a Schedule 1 DPA 2018 condition too.

Criminal offence data

Data about criminal convictions, offences or related security measures. It has its own regime (Article 10 UK GDPR and Schedule 1 DPA 2018).

Controller and processor

The controller decides why and how personal data is used (your business). A processor acts on the controller’s instructions (your agency, CRM, email platform or payroll provider). Processors have direct obligations too, and must have an Article 28 contract with the controller.

Processing

Almost anything you do with data: collecting, storing, viewing, analysing, sharing, uploading to an ad platform, deleting.

Data subject

The living person the data is about: customers, prospects, staff, website visitors.

Restricted transfer

Sending personal data, or making it accessible, to a separate organisation outside the UK. It needs adequacy regulations, an appropriate safeguard or an exception.

Pseudonymised vs anonymised data

Pseudonymised data (for example hashed emails or customer IDs) is still personal data. Truly anonymised data, where no one can reasonably re-identify individuals, falls outside the law. Re-identifying de-identified data without the controller’s consent can be a criminal offence (s.171 DPA 2018).

Who Must Comply With the Data Protection Act 2018 and UK GDPR?

The UK GDPR applies to the processing of personal data by organisations established in the UK, and to some organisations outside the UK. The DPA 2018 applies alongside it to the same organisations.

UK-based organisations

Every UK company, partnership, sole trader, charity, school, club and public body that processes personal data in the context of its activities, whether the data is about UK residents or not. Purely personal or household activity (your own phone contacts) is outside scope.

Non-UK organisations targeting the UK

Under Article 3(2), an organisation outside the UK is caught if it offers goods or services to people in the UK (for example pricing in pounds, UK delivery, a .co.uk site) or monitors their behaviour in the UK (for example tracking and profiling UK website visitors).

Appointing a UK representative

Most non-UK organisations caught by Article 3(2) must appoint a representative in the UK (Article 27), unless their processing is occasional and low risk. US, Indian, Australian and EU businesses selling to UK consumers often miss this.

Does it apply to small businesses and sole traders?

Yes. There is no turnover or headcount threshold. Small organisations get proportionate treatment, not an exemption: most do not need a DPO, some are exempt from detailed records of processing, and the data protection fee is £52 for micro organisations.

Quick test: are you in scope?

Question	If yes	If no
Do you handle information about identifiable living people?	Continue	Out of scope
Is it only for personal or household purposes?	Out of scope	Continue
Are you established in the UK?	In scope (UK GDPR + DPA 2018)	Continue
Do you offer goods or services to, or monitor, people in the UK?	In scope; consider a UK representative	Likely out of UK GDPR scope (check EU GDPR and local law)
Do you use cookies or send marketing to UK users?	PECR applies too	–

The 7 Data Protection Principles Under the UK GDPR

Article 5 is the heart of the law. Breaching a principle falls in the higher fine tier, so every decision you make about data should trace back to these seven.

#	Principle	What it means in practice	Marketing example
1	Lawfulness, fairness and transparency	Have a lawful basis, do nothing people would not reasonably expect, tell them clearly	Clear privacy notice at sign-up; no hidden tracking
2	Purpose limitation	Collect for specified purposes; new uses must be compatible	Event-registration emails are not automatically a marketing list
3	Data minimisation	Collect only what you need	Do not ask for date of birth on a webinar form
4	Accuracy	Keep data correct and up to date	Process bounces and unsubscribes promptly
5	Storage limitation	Keep data no longer than necessary	Delete cold leads after a set period, such as 24 months
6	Integrity and confidentiality (security)	Protect against loss, misuse and unauthorised access	MFA on ad accounts; no CSV exports in personal email
7	Accountability	Be able to prove compliance	Records of processing, DPIAs, consent logs, DPAs with suppliers

Why some sources say six or eight principles

Article 5(1) lists six principles and Article 5(2) adds accountability, which is why both “six” and “seven” appear. The “eight principles” belong to the repealed Data Protection Act 1998. Part 3 of the DPA 2018 has its own six principles, but they apply only to law enforcement processing.

Purpose limitation after the DUAA

Since 5 February 2026, the UK GDPR includes a list of purposes that are treated as compatible with the original purpose (Annex 2), such as certain public-interest, safeguarding and crime-prevention uses. This is narrower than many headlines suggest: repurposing customer data for unrelated marketing still needs a fresh assessment, and often consent.

Lawful Bases for Processing Personal Data (Article 6)

You need at least one lawful basis for every processing purpose, decided and documented before you start. Since February 2026 there are seven.

Lawful basis	Article	Typical use	Watch out
Consent	6(1)(a)	Marketing emails to individuals, non-essential cookies	Must be freely given, specific, informed, unambiguous and easy to withdraw
Contract	6(1)(b)	Processing an order, delivering a service	Only what is genuinely necessary for the contract
Legal obligation	6(1)(c)	Payroll records for HMRC, right-to-work checks	Point to the specific law
Vital interests	6(1)(d)	Medical emergency	Rarely relevant to businesses
Public task	6(1)(e)	Councils, schools, NHS functions	Mainly public bodies
Recognised legitimate interests (new)	6(1)(ea) + Annex 1	Crime prevention, safeguarding, emergencies, national security, responding to public-body requests	Only the listed purposes; no balancing test needed
Legitimate interests	6(1)(f)	Fraud prevention, B2B marketing, network security, analytics	Needs a three-part legitimate interests assessment (LIA)

The new seventh basis: recognised legitimate interests

The DUAA added Article 6(1)(ea). If your purpose is on the Annex 1 list, you can rely on it without weighing your interests against the individual’s.

What is on the Annex 1 list

Disclosures to public bodies that need the data for their public tasks
National security, public security and defence
Emergencies
Detecting, investigating or preventing crime
Safeguarding vulnerable individuals

What it does not cover

Marketing, analytics, personalisation and ad targeting are not recognised legitimate interests. They still need consent or ordinary legitimate interests with a documented balancing test.

Tip: keep your LIA templates

Most marketing teams will use ordinary legitimate interests more often than the new basis. Keep a short LIA for each marketing purpose: purpose test, necessity test, balancing test.

Legitimate interests and direct marketing

The UK GDPR now states (Article 6(9)) that direct marketing, intra-group transfers for internal administration, and keeping networks and systems secure are examples of processing that may be legitimate interests. That helps, but you still need the balancing test, and PECR consent rules still decide whether you can email, text or call.

Freely given: no forced bundling with terms and conditions; not a condition of service unless necessary.
Specific and granular: separate opt-ins for separate purposes (email vs SMS vs partner offers).
Informed: name your organisation, the purposes and the right to withdraw.
Unambiguous, affirmative action: no pre-ticked boxes, no “by browsing you agree”.
Recorded: who, when, how, and what they were told.
As easy to withdraw as to give: one-click unsubscribe, cookie settings link on every page.
Children: for online services offered directly to children, 13 is the age of consent in the UK.

Special category data: Article 9 plus Schedule 1

To use special category data you need an Article 6 basis and an Article 9 condition. For several Article 9 conditions (employment, substantial public interest, health and social care, research) you must also meet a condition in Schedule 1 of the DPA 2018, and many require an appropriate policy document explaining how you comply.

Schedule 1 conditions marketers and SMEs meet most often

Situation	Typical route
Staff sickness and occupational health	Art 9(2)(b) + Sch 1 para 1 (employment)
Equality and diversity monitoring	Art 9(2)(g) + Sch 1 para 8 (equality of opportunity)
Fraud prevention	Art 9(2)(g) + Sch 1 para 14
Health-based ad targeting or audiences	Usually explicit consent, Art 9(2)(a), and a DPIA; often best avoided

Individual Rights Under the UK GDPR

People have eight rights over their personal data, plus a new right to complain to you directly. Most must be answered within one month.

Right	Article	What people can ask	Deadline
Right to be informed	13–14	Clear information on what you collect, why, how long and who you share with	At collection (or within one month if obtained indirectly)
Right of access (SAR)	15	A copy of their data plus supporting information	1 month (+2 if complex)
Right to rectification	16	Correct inaccurate data	1 month
Right to erasure	17	Delete data in certain circumstances	1 month
Right to restrict processing	18	Pause use while a dispute is resolved	1 month
Right to data portability	20	Receive data in a machine-readable format or have it moved	1 month
Right to object	21	Stop processing; absolute for direct marketing	Marketing: stop immediately
Automated decision-making rights	22A–22D	Information, to make representations, human intervention, to contest	With the decision

Subject access requests after the DUAA

Since 5 February 2026, a new Article 12A puts several long-standing ICO positions into law.

What is now written into the law

Stop the clock: the deadline pauses while you wait for information you reasonably need to identify the person or clarify the request.
Reasonable and proportionate searches: you must search properly, but not for every conceivable trace of data.
Timing: one month from receipt (or from receiving ID or a fee where allowed), extendable by two months for complex or multiple requests.

Manifestly unfounded or excessive requests

You may refuse, or charge a reasonable fee, but you must explain why and tell the person they can complain to the ICO or go to court. Keep evidence of your reasoning.

Automated decision-making after the DUAA

Articles 22A–22D replaced Article 22. Solely automated decisions with legal or similarly significant effects are now generally permitted with safeguards: tell people about the decision, let them make representations, offer meaningful human intervention and let them contest it. Stricter limits remain where special category data is used. Credit scoring, automated recruitment screening and dynamic pricing that significantly affect people are the usual examples.

The new right to complain to your organisation (from 19 June 2026)

Section 164A DPA 2018 gives people the right to complain directly to a controller about an alleged infringement. It applies to every controller, including sole traders and small charities.

What your complaints process must do

Make it easy to complain, including an electronic option such as a form or dedicated email address.
Acknowledge receipt within 30 days.
Take appropriate steps to respond without undue delay, including making enquiries.
Keep the complainant informed of progress.
Tell them the outcome without undue delay.

Mention the process in your privacy notice. The government can also require controllers to report complaint numbers (s.164B).

Is there a "right to repatriation"?

No. It is a common quiz distractor. The real right is data portability: receiving your data in a structured, commonly used, machine-readable format and having it transmitted to another organisation where technically feasible.

Accountability: What UK Businesses Must Actually Do

Accountability means you can show your homework. These are the documents and controls an investigator, a client’s procurement team or an enterprise buyer will ask for.

Pay the data protection fee

Tier	Who	Annual fee	By direct debit
Tier 1 – micro	Turnover up to £632,000 or no more than 10 staff (also most charities and small occupational pension schemes)	£52	£47
Tier 2 – small and medium	Turnover up to £36 million or no more than 250 staff	£78	£73
Tier 3 – large	Everyone else	£3,763	£3,758

Some processing is exempt (for example only staff administration, or only your own accounts and records). Not paying when you should can lead to a fixed penalty. Beware of third-party letters demanding other amounts.

Keep records of processing activities (Article 30)

List what personal data you hold, why, the lawful basis, who you share it with, transfers abroad, retention and security. Organisations with fewer than 250 staff are only partly exempt: you still need records for processing that is regular, risky or involves special category or criminal offence data, which in practice covers most marketing.

Carry out DPIAs for high-risk processing (Article 35)

A data protection impact assessment is mandatory before processing likely to result in high risk: large-scale profiling, systematic monitoring, special category data at scale, innovative technology such as AI on customer data, children’s data, invisible processing, and combining datasets. Missing DPIAs featured in the ICO’s 2026 fine against Reddit.

Appoint a Data Protection Officer if required (Article 37)

A DPO is mandatory if you are a public authority, or your core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal offence data. Otherwise it is optional, but someone should own data protection.

Publish clear privacy notices (Articles 13–14)

Explain who you are, what you collect, purposes and lawful bases, recipients, transfers, retention, rights, how to complain to you (s.164A) and to the ICO, and any automated decisions. Update references from “Information Commissioner’s Office” to the Information Commission.

Secure the data (Article 32)

Use measures appropriate to the risk: MFA, least-privilege access, encryption, patching, backups, supplier checks, staff training. Cyber Essentials is a sensible UK baseline. Security failures drove the ICO’s largest penalties: Capita (£14 million, October 2025) and British Airways (£20 million, 2020).

Sign Article 28 contracts with every processor

Your agency, CRM, email platform, hosting and payroll providers need a written contract that covers:

Processing only on your documented instructions
Confidentiality of staff
Appropriate security measures
Sub-processors only with your authorisation, on the same terms
Helping you with rights requests, DPIAs and breaches
Deleting or returning data at the end of the contract
Making information available for audits and inspections

Protect children's data

The UK age of consent for online services offered directly to children is 13. Services likely to be accessed by children should follow the ICO’s Age Appropriate Design Code (Children’s Code). Children’s data enforcement is a current ICO priority.

Personal Data Breaches and the 72-Hour Rule

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A misdirected email, a lost laptop, a hacked ad account with customer audiences and ransomware all count.

Who must be told, and when

Who	When	Trigger
Controller (by its processor)	Without undue delay	Any breach the processor becomes aware of
ICO	Within 72 hours of becoming aware	Unless unlikely to result in a risk to individuals
Affected individuals	Without undue delay	If likely to result in a high risk
Internal breach log	Always	Every breach, reported or not

What a report should contain

What happened, when, and how you found out
Categories and approximate numbers of people and records
Likely consequences
Measures taken or proposed, including to reduce harm
A contact point (DPO or data lead)

If you do not have all the facts within 72 hours, report what you know and follow up in phases.

Fines, Enforcement and Criminal Offences

The two fine tiers

Tier	Maximum	Examples of infringements
Higher	£17.5 million or 4% of worldwide annual turnover, whichever is higher	Principles, lawful bases, consent, individuals’ rights, international transfers
Standard	£8.7 million or 2% of worldwide annual turnover, whichever is higher	Records, DPIAs, DPO duties, processor contracts, breach notification, security obligations of processors
PECR (since 5 Feb 2026)	Up to £17.5 million or 4% of turnover (previously £500,000)	Unlawful cookies and tracking, spam emails and texts, nuisance calls

Recent ICO penalties worth knowing

Organisation	Year	Penalty	Main issue
Reddit	2026	£14.47 million	Children’s data: no lawful basis for under-13s, no DPIA
Capita plc and Capita Pension Solutions	2025	£14 million	Security failures behind a cyber attack
23andMe	2025	£2.31 million	Security failures exposing genetic data
South Staffordshire Water	2026	£963,900	Security and breach response failures
TikTok	2023	£12.7 million	Children’s data used without proper consent
British Airways	2020	£20 million	Security failures behind a payment-card breach

Fines are only one tool. The regulator can also issue reprimands, enforcement notices (orders to stop or fix processing), information and assessment notices, and, since the DUAA, require interviews and technical reports. Most SME enforcement relates to PECR marketing breaches rather than UK GDPR fines.

Criminal offences under the Data Protection Act 2018

Section	Offence
s.170	Knowingly or recklessly obtaining, disclosing or retaining personal data without the controller’s consent (for example staff taking a client list to a new job)
s.171	Re-identifying de-identified personal data without consent
s.173	Altering, defacing, blocking, erasing or concealing data to stop it being disclosed in response to a request
s.144 / s.148	False statements to the regulator; destroying or falsifying information it has asked for
s.198	Directors and managers can be personally liable if the company’s offence involved their consent, connivance or neglect

Compensation claims

People who suffer material or non-material damage (including distress) because of an infringement can claim compensation from the controller or processor (Article 82 UK GDPR and s.168 DPA 2018). Group claims after large breaches are increasingly common.

The New Information Commission: What Changed on 30 September 2026

The Data (Use and Access) Act 2025 abolished the office of the Information Commissioner, a single person holding all legal powers (a “corporation sole”), and transferred every function to a new Information Commission: a body corporate run by a board of executive and non-executive members. The change took effect on 30 September 2026.

What changed	What did not change
Legal entity: the Information Commission, led by a board	The ICO name: it is now the Information Commission’s Office
Collective decision-making instead of one Commissioner	Its powers under the UK GDPR, DPA 2018, PECR and FOI law
The data protection fee is now paid to the Commission	Fee amounts (£52 / £78 / £3,763)
New head office in Manchester	Maximum fines and enforcement tools

What to update in your documents

Privacy notices and complaints wording: “the Information Commission (ICO)” rather than “the Information Commissioner’s Office”.
Breach procedures and contracts that name “the Commissioner”.
Staff training slides and internal policies.

What Changed in 2025–2026: The Data (Use and Access) Act Explained

The DUAA received Royal Assent on 19 June 2025 and was commenced in stages. It is an evolution, not a reset: if you complied in 2025, most of your framework still stands, but several documents and processes need updating.

Area	Before	Now (in force)	What to do
Lawful bases	Six bases	Seventh basis: recognised legitimate interests (Annex 1)	Check if any safeguarding or crime-prevention processing can move to it
Legitimate interests	Balancing test for everything	Direct marketing, intra-group admin and security named as possible legitimate interests	Keep LIAs; PECR rules unchanged
Purpose limitation	Case-by-case compatibility	Annex 2 list of compatible purposes	Review reuse of data against the list
Subject access requests	Rules mostly in ICO guidance	Article 12A: stop the clock, reasonable and proportionate searches	Update SAR procedure and templates
Automated decisions	General prohibition (Art 22)	Permitted with safeguards (Arts 22A–22D); stricter for special category data	Map automated decisions; add human review route
Cookies (PECR)	Consent for all non-essential cookies	Exemptions for low-risk uses such as first-party statistics, appearance/functionality, security and software updates, with an opt-out	Re-audit tags; keep consent for ads and third-party tracking
PECR fines	£500,000 maximum	£17.5 million or 4% of turnover	Treat cookie and email compliance as board-level risk
International transfers	“Essentially equivalent” style assessments	Data protection test: protection “not materially lower” than the UK	Update transfer risk assessments; keep IDTAs
Complaints	No statutory duty	s.164A: acknowledge within 30 days, investigate, report outcome (from 19 June 2026)	Publish a complaints route; train staff
Research	Narrow consent rules	Broader definition of scientific research and broad consent	Relevant for R&D and product analytics
Regulator	Information Commissioner’s Office	Information Commission (from 30 Sep 2026)	Update names in documents

UK GDPR vs EU GDPR vs Other Tier 1 Privacy Laws

Topic	UK GDPR + DPA 2018	EU GDPR
Maximum fine	£17.5m or 4% of turnover	€20m or 4% of turnover
Regulator	Information Commission (ICO)	27+ national authorities, EDPB, one-stop shop
Age of consent for online services	13	16 by default (member states can lower to 13)
Lawful bases	7, including recognised legitimate interests	6
Automated decisions	Permitted with safeguards (22A–22D)	General right not to be subject (Art 22)
Analytics cookies	Can be exempt from consent with an opt-out	Consent generally required (national ePrivacy laws)
Transfer tools	IDTA, UK Addendum, UK data bridges	EU SCCs, adequacy decisions, BCRs
Representative	UK representative (Art 27)	EU representative (Art 27)
Courts	UK courts	CJEU and national courts

Does the EU still consider the UK adequate?

Yes. On 19 December 2025 the European Commission renewed both UK adequacy decisions (under the GDPR and the Law Enforcement Directive) after assessing the DUAA. Personal data can keep flowing from the EEA to the UK without extra safeguards until 27 December 2031, with a review after four years. If you sell into the EU as well as the UK, you still comply with both regimes for the relevant data.

How the UK compares with other Tier 1 privacy laws

Law	Country	Max penalty (headline)	Breach notice	Who it protects
UK GDPR + DPA 2018	United Kingdom	£17.5m / 4% turnover	72 hours to ICO	People in the UK
EU GDPR	EU/EEA	€20m / 4% turnover	72 hours to lead authority	People in the EU/EEA
Privacy Act 1988 (APPs)	Australia	Tiered civil penalties	Assess within 30 days, then notify OAIC	Individuals in Australia
Privacy Act 2020 (IPPs)	New Zealand	Fines and Tribunal damages	As soon as practicable (OPC expects about 72 hours)	Individuals in NZ
CCPA/CPRA	California, US	Per-violation administrative fines	Under state breach laws	California residents
DPDP Act 2023	India	Up to ₹250 crore	To the Data Protection Board	Data principals in India

Selling into Australia or New Zealand too? See our related guides to the Australian Privacy Principles and the NZ Privacy Act 2020.

The Data Protection Act 2018 and UK GDPR for Marketers

Marketing teams sit where UK GDPR and PECR overlap. Since February 2026 the stakes are equal: a cookie or spam failure can now attract the same maximum fine as a data breach.

Cookies, pixels and tracking after the DUAA

Regulation 6 of PECR still requires consent before storing or accessing information on a user’s device, unless an exemption applies. The ICO’s guidance, finalised on 29 April 2026, is technology-neutral: it covers cookies, pixels, tags, local storage, fingerprinting and link decoration.

Statistical purposes: first-party analytics used only to understand and improve your own service.
Appearance and functionality: remembering a user’s chosen settings, such as language or layout.
Security: protecting the service or user, for example fraud and bot detection.
Software updates: keeping software on the device secure and up to date.

Conditions you must meet

Give clear and comprehensive information, and a simple, free way to object (an opt-out). The exemption only covers that sole purpose: the moment data feeds advertising, audiences or third parties’ own purposes, consent is needed.

Common tools: consent needed?

Tool / tag	Consent needed in the UK?	Why
Self-hosted, first-party analytics (no third-party sharing)	Usually no (opt-out required)	Fits the statistical purposes exemption
Google Analytics 4 (standard set-up)	Generally yes	Data goes to a third party and often links to Google Ads
Meta Pixel / Conversions API with browser tag	Yes	Advertising and cross-site tracking
LinkedIn Insight Tag, TikTok Pixel	Yes	Advertising and audience building
Session recording (for example Hotjar, Clarity)	Usually yes	Third-party processing beyond simple statistics
Load balancing, shopping basket, security cookies	No	Strictly necessary or security exemption

Open your site in a private window, decline all, and check the network tab. If ad pixels fire before consent, you have a PECR problem that now carries GDPR-level fines.

Email and SMS marketing

Audience	Rule	Notes
Individual consumers (and sole traders, some partnerships)	Prior consent, or the “soft opt-in”	Soft opt-in: details obtained during a sale or negotiation, similar products, opt-out offered at collection and in every message
Charity supporters	Charities can now use a version of the soft opt-in	For people who supported or expressed interest in the charity’s purposes
Corporate subscribers (limited companies, LLPs, government)	No PECR consent needed	Must identify yourself and offer an opt-out; UK GDPR still applies to the named employee’s data
Everyone	Honour unsubscribes immediately; keep a suppression list	The right to object to direct marketing is absolute

Custom audiences, CRM uploads and lookalikes

Hashing emails before upload is pseudonymisation, not anonymisation. It is still personal data.
Tell people in your privacy notice that you share data with ad platforms for audience matching.
Respect objections and unsubscribes by excluding those people from audiences.
Large-scale profiling or combining datasets usually needs a DPIA.

AI tools and personal data

Do not paste customer lists, CRM exports or call transcripts into consumer AI tools.
Use business tiers with data processing terms and no training on your inputs.
Run a DPIA for AI that profiles customers or makes significant automated decisions (Articles 22A–22D).
Be transparent: tell people where AI is used in decisions about them.

Marketer's UK GDPR checklist

Check	Done?
Cookie banner blocks ad tags until opt-in; reject is as easy as accept	☐
Analytics configured to qualify for the exemption, or kept behind consent	☐
Every form has clear purposes and separate, unticked marketing opt-ins	☐
Consent records stored (who, when, what wording)	☐
Privacy notice covers ad platforms, audiences, transfers, s.164A complaints	☐
Article 28 DPAs signed with agency, CRM, ESP and analytics vendors	☐
Suppression list synced to every platform	☐
MFA on ad, analytics and CRM accounts; access reviewed quarterly	☐
DPIA for profiling, lookalikes at scale or AI personalisation	☐
Retention rule for leads and campaign data applied	☐

10-Step Compliance Checklist for UK SMEs

Use this order. Each step builds the evidence for the next.

1. Map your data

List the personal data you hold, where it lives (CRM, spreadsheets, ad platforms, inboxes) and who can access it.

2. Pay the data protection fee

Check your tier and pay, or record why you are exempt.

3. Choose and record lawful bases

One per purpose. Write LIAs for legitimate interests and keep consent records.

4. Update privacy notices

Plain English, layered, covering transfers, retention, rights, the new complaints route and the Information Commission.

5. Fix cookies and marketing consent

Audit every tag against the 2026 exemptions; block ad pixels until opt-in.

6. Sign processor contracts

Article 28 terms with every supplier; IDTA or UK Addendum for any non-adequate country.

7. Set retention periods

Decide how long you keep each data type, then automate deletion where you can.

8. Secure systems

MFA, least privilege, encryption, patching, backups; consider Cyber Essentials.

9. Prepare for requests, complaints and breaches

SAR procedure with stop-the-clock rules, a complaints process with a 30-day acknowledgement, and a 72-hour breach playbook.

10. Train, test and review

Annual staff training, quarterly access reviews, DPIAs for new projects, and a yearly compliance review.

Free official resources

ICO guide to the UK GDPR and DUAA hub (ico.org.uk)
ICO self-assessment toolkits and SME hub
UK GDPR and DPA 2018 on legislation.gov.uk (revised versions)
NCSC Cyber Essentials guidance
ICO storage and access technologies (cookies) guidance, April 2026

International Data Transfers Under the UK GDPR (Including India)

Chapter V of the UK GDPR restricts transfers of personal data to separate organisations outside the UK. The ICO’s January 2026 guidance makes the party that initiates the transfer responsible for getting it right, whether it is a controller or a processor.

Three ways to make a restricted transfer lawful

Route	When it applies	Examples
UK adequacy regulations (“data bridges”)	Destination approved by the UK government	EEA countries, the US under the UK Extension to the Data Privacy Framework (certified companies), and others on the UK list
Appropriate safeguards (Article 46)	No adequacy	UK IDTA, EU SCCs with the UK Addendum, binding corporate rules
Exceptions (Article 49)	Occasional, limited cases	Explicit consent, necessary for a contract with the individual

IDTA or UK Addendum?

	UK IDTA	EU SCCs + UK Addendum
Best for	Transfers subject only to UK law	Groups also exporting EU data under EU SCCs
Format	Standalone UK agreement	Short addendum bolted onto EU SCCs
Article 28 terms	Need a separate DPA	Need a separate DPA (or use processor modules)
Updates	ICO plans DUAA updates in 2026; can be set to update automatically	Same

The data protection test

When relying on a safeguard, you must check that the protection in the destination, taken together with the safeguard, is not materially lower than in the UK. This replaced the old “transfer risk assessment” label. Consider public authority access to data and whether people’s rights are enforceable, and add supplementary measures (encryption, access controls, minimisation) where needed. Agreements made before 5 February 2026 that were compliant then continue to count.

Transfers to India

India is not covered by UK adequacy regulations, so UK businesses sending personal data to, or giving access to, an Indian supplier need the IDTA or Addendum, a data protection test and an Article 28 contract. India’s own Digital Personal Data Protection Act 2023, with Rules notified in November 2025 and phased in through 2027, now adds a domestic layer of security and breach obligations for Indian companies.

Using an Offshore Marketing Agency Under the Data Protection Act 2018 and UK GDPR

Many UK businesses and agencies outsource SEO, content, PPC and analytics to India for cost and capacity. That is lawful when it is set up properly. Here is exactly how Digital Masters 360, a Hyderabad-based agency serving UK clients 100% online, does it, so you can hold any supplier to the same standard.

Is it legal to outsource digital marketing to India?

Yes. The UK GDPR does not ban offshore suppliers. It requires a lawful transfer route, a processor contract, security, and transparency. For most SEO and content work, the offshore team can be set up to never handle identifiable personal data at all.

Route 1: no personal data leaves the UK

SEO audits, content, technical fixes and reporting from aggregated analytics usually need no personal data. We work in your accounts with access restricted to aggregate reports, so no restricted transfer takes place.

Route 2: processor with IDTA

Where work needs personal data (CRM segments, ad audiences, lead handling), we act as your processor under an Article 28 DPA plus the UK IDTA (or the Addendum if you already use EU SCCs), and we give you the information you need for your data protection test.

What we never do

Download client customer lists to personal devices or personal cloud storage
Paste personal data into AI tools without business data terms
Use sub-processors you have not approved
Keep data after the contract ends

How Digital Masters 360 handles UK client data

Access model

Client-owned accounts (Google, Meta, LinkedIn, CRM) with named user access, least-privilege roles and MFA. No shared logins.

Data minimisation

Aggregate reporting by default; personal data only where a task genuinely needs it, documented per task.

Security

Company-managed devices, encrypted storage, password manager, access logs and quarterly access reviews.

Breach commitment

We notify you within 24 hours of becoming aware of any incident affecting your data, so you can meet the 72-hour ICO deadline.

Sub-processors

A published list (for example workspace, project management and reporting tools), with advance notice of changes.

Offboarding

At the end of the engagement we return or delete data and confirm in writing.

Revoke our access in one step

Because you own every account, removing our users ends our access immediately.

Cost savings vs UK agencies

UK agency retainers for SEO and digital marketing commonly run from about £1,000 to £5,000+ a month. Offshore delivery from Hyderabad lets UK SMEs and agencies get senior-level execution for less. Indicative monthly pricing:

Indicative prices, excluding VAT and ad spend. Currency figures are approximate conversions.
Plan	GBP (UK)	USD	EUR	AUD	Best for
Starter	£495	$665	€570	A$990	Local and small UK businesses
Growth	£950	$1,275	€1,095	A$1,890	Growing SMEs, ecommerce
Scale	£1,800	$2,420	€2,075	A$3,590	Multi-location and B2B
White-label (agencies)	from £395	from $530	from €455	from A$790	UK agencies reselling SEO
UK GDPR-ready marketing audit (one-off)	£750	$1,010	€865	A$1,490	Cookie, consent, tag and supplier review

Your provider should also be able to tell you, in writing, which personal data (if any) the engagement involves, which transfer mechanism applies, and how to switch off access. If they cannot, the saving is not worth it.

Time-zone overlap and communication

UK period	UK time	India (IST)	DM360 UK-overlap shift
British Summer Time (late March–late October)	BST (UTC+1)	UK + 4 h 30 m	1:30 pm–10:30 pm IST = 9:00 am–6:00 pm BST
Greenwich Mean Time (late October–late March)	GMT (UTC+0)	UK + 5 h 30 m	1:30 pm–10:30 pm IST = 8:00 am–5:00 pm GMT

How we communicate

Shared Slack or Microsoft Teams channel, answered within 4 business hours
Weekly 30-minute Zoom, Google Meet or Teams call at a UK-friendly time
Live Looker Studio dashboard plus a monthly written report in plain English
A named account lead and documented escalation route

Contracts, NDAs, payments and onboarding

Your contract pack

Master services agreement and statement of work (governed by English law on request)
Mutual NDA signed before any access
Article 28 data processing agreement
UK IDTA or Addendum where personal data is transferred
Security schedule and sub-processor list

Payment methods

GBP invoices payable by UK bank transfer (via Wise or similar), card, or PayPal. Monthly in advance, no long lock-in after the first 90 days.

14-day onboarding

Day 1–2: discovery call, NDA, contracts and DPA signed
Day 3–5: account access granted (least privilege), data map agreed
Day 6–10: audit (SEO, tracking, consent, competitors)
Day 11–14: 90-day plan, KPIs and reporting dashboard live

White-label partnership for UK agencies

UK agencies can resell our SEO, content and reporting under their own brand. We sign a white-label NDA, sit in your processor chain as an approved sub-processor (with flow-down Article 28 terms and IDTA where needed), and never contact your clients directly.

Common Data Protection Mistakes UK Businesses Make

Mistake	Why it matters	Fix
Thinking UK GDPR replaced the DPA 2018 (or vice versa)	You miss Schedule 1 conditions and exemptions	Comply with both and cite both
Ad pixels firing before consent	PECR fines now up to £17.5m / 4%	Block tags until opt-in; test monthly
Assuming GA4 is covered by the new analytics exemption	Third-party sharing takes it out of the exemption	Keep GA4 behind consent or switch to qualifying first-party analytics
Pre-ticked or bundled consent	Consent is invalid	Separate, unticked opt-ins
No complaints route	Breaches s.164A since 19 June 2026	Publish a form and email; 30-day acknowledgement
No Article 28 contract with the agency	Standard-tier infringement and weak control	Sign a DPA with every processor
Sending data offshore without an IDTA	Unlawful restricted transfer (higher tier)	IDTA/Addendum plus data protection test
Keeping leads forever	Breaches storage limitation	Retention schedule with automatic deletion
Old privacy notice	Names the abolished Commissioner; misses new rights	Update after every legal change
Missing the 72-hour breach window	Aggravates enforcement	Breach playbook and supplier notice terms

Glossary of UK Data Protection Terms

Term	Meaning
DPA 2018	Data Protection Act 2018, the UK Act that supplements the UK GDPR
UK GDPR	UK General Data Protection Regulation, the core UK data protection rules since 1 January 2021
DUAA	Data (Use and Access) Act 2025, which amended the UK GDPR, DPA 2018 and PECR
PECR	Privacy and Electronic Communications Regulations 2003: cookies and electronic marketing
ICO / Information Commission	The UK regulator; the Information Commission (still called the ICO) since 30 September 2026
Controller / processor	Who decides the purposes / who acts on the controller’s instructions
LIA	Legitimate interests assessment: purpose, necessity and balancing tests
DPIA	Data protection impact assessment for high-risk processing
DPO	Data Protection Officer
RoPA	Record of processing activities (Article 30)
SAR / DSAR	(Data) subject access request
IDTA	International Data Transfer Agreement for restricted transfers from the UK
UK Addendum	Addendum that adapts the EU SCCs for UK transfers
Data protection test	Check that protection abroad is not materially lower than in the UK
Adequacy / data bridge	A government finding that a country protects data adequately
Soft opt-in	PECR rule allowing marketing emails to existing customers about similar products, with an opt-out
Special category data	Sensitive data under Article 9 (health, biometrics, ethnicity and more)
Recognised legitimate interests	Lawful basis 6(1)(ea) for listed public-interest purposes

Frequently Asked Questions About the Data Protection Act 2018 and UK GDPR

What is the difference between the Data Protection Act 2018 and the UK GDPR?

The UK GDPR contains the core rules: the seven principles, the lawful bases, individuals’ rights, security, breach reporting, international transfers and fines. The Data Protection Act 2018 sits alongside it and fills in UK-specific detail: the conditions for special category and criminal offence data (Schedule 1), the exemptions (Schedules 2 to 4), the regulator’s powers, criminal offences, and separate regimes for law enforcement (Part 3) and the intelligence services (Part 4). You read them together; most organisations need both.

Is the UK GDPR still in force in 2026?

Yes. The UK GDPR has applied since 1 January 2021 and remains the UK’s main data protection law. The Data (Use and Access) Act 2025 amended it (mainly from 5 February 2026) but did not replace it. The Data Protection Act 2018 is also still in force, as amended.

Did the Data (Use and Access) Act 2025 replace the Data Protection Act 2018?

No. The DUAA is an amending Act. It changes parts of the UK GDPR, the Data Protection Act 2018 and PECR (for example recognised legitimate interests, subject access requests, automated decisions, cookies, complaints and higher PECR fines) but the DPA 2018 and UK GDPR remain the laws you comply with.

How many data protection principles are there under the UK GDPR?

Seven. Article 5(1) lists six (lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality) and Article 5(2) adds accountability. The ‘eight principles’ you sometimes see come from the repealed Data Protection Act 1998, and the ‘six principles’ in Part 3 of the DPA 2018 apply only to law enforcement processing.

Who enforces the Data Protection Act 2018 and the UK GDPR?

The Information Commission. On 30 September 2026 it took over all the functions of the Information Commissioner’s Office. It is still known as the ICO (now the Information Commission’s Office) and its powers and maximum fines are unchanged.

What is the maximum fine under the UK GDPR?

Up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements (such as breaching the principles or individuals’ rights). Other infringements carry up to £8.7 million or 2%. Since 5 February 2026, serious PECR breaches (cookies, marketing calls, texts and emails) carry the same higher maximum.

Does the UK GDPR apply to small businesses and sole traders?

Yes. There is no small-business exemption. If you handle personal data about customers, staff or prospects for business purposes, the UK GDPR and DPA 2018 apply. Small organisations do get some relief, for example most do not need a Data Protection Officer, and the data protection fee for micro organisations is £52 a year.

Do I need to register with the ICO and pay the data protection fee?

Most organisations that process personal data must pay the annual data protection fee unless an exemption applies. The tiers are £52 (micro), £78 (small and medium) and £3,763 (large), with £5 off if you pay by direct debit. From 30 September 2026 the fee is paid to the Information Commission.

Does the UK GDPR apply to companies outside the UK?

Yes, if they offer goods or services to people in the UK or monitor their behaviour in the UK (Article 3(2)). Such organisations usually need to appoint a UK representative under Article 27. A US, Indian or Australian business selling online to UK customers can therefore be directly subject to the UK GDPR.

What rights do individuals have under the UK GDPR?

Eight: the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights related to automated decision-making including profiling. Since 19 June 2026 people can also complain directly to the organisation, which must acknowledge the complaint within 30 days.

Is there a 'right to repatriation' under the UK GDPR?

No. There is no right to repatriation. The phrase appears in quiz questions as a distractor. The closest real right is the right to data portability, which lets people receive their data in a structured, commonly used, machine-readable format and have it moved to another organisation.

How long do I have to respond to a subject access request?

One month from receipt, extendable by up to two further months if the request is complex or the person has made several requests. Since 5 February 2026 the law confirms you can pause the clock while you wait for information you reasonably need to clarify the request, and that you only need to make reasonable and proportionate searches.

When must a personal data breach be reported to the ICO?

Within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. If the breach is likely to result in a high risk, you must also tell the affected individuals without undue delay. Processors must tell the controller without undue delay. Keep a record of every breach, reported or not.

Do I still need consent for analytics cookies in the UK?

Sometimes not. Since 5 February 2026, PECR allows certain low-risk cookies, including analytics used only to produce statistics for improving your own service, to be used without consent if you give clear information and a simple, free way to object. Tools that share data with third parties for their own purposes or feed advertising, such as most GA4 and Meta Pixel set-ups, still need prior opt-in consent.

Can I send UK personal data to India or use an Indian agency?

Yes, if you do it lawfully. India is not covered by UK adequacy regulations, so a restricted transfer needs an appropriate safeguard, usually the UK International Data Transfer Agreement (IDTA) or the EU SCCs with the UK Addendum, plus a documented data protection test and an Article 28 processor contract. Many marketing engagements can also be designed so the offshore team never accesses identifiable personal data at all.

Can an individual be held personally responsible under the UK GDPR?

Fines under the UK GDPR are imposed on organisations, but the Data Protection Act 2018 creates criminal offences that individuals can commit, such as knowingly or recklessly obtaining or disclosing personal data without the controller’s consent (section 170). Directors and managers can also be personally liable where an offence by a company is committed with their consent or connivance, or is attributable to their neglect (section 198).

Is UK GDPR the same as EU GDPR?

They started identical but are now separate regimes. Key differences include the UK’s lower age of consent for online services (13), recognised legitimate interests, different rules on automated decisions, cookie exemptions, fines in pounds (£17.5 million) and UK-specific transfer tools such as the IDTA. The EU renewed its adequacy decisions for the UK on 19 December 2025, so EU-to-UK data flows remain free until at least 27 December 2031.

What does the Data Protection Act 2018 set out?

It sets out how the UK GDPR applies in the UK (Part 2), a separate regime for law enforcement processing (Part 3) and for the intelligence services (Part 4), the regulator’s role (Part 5), enforcement, penalties and criminal offences (Part 6) and supplementary provisions (Part 7), plus schedules covering special category conditions and exemptions.

Get a Free UK GDPR-Ready Marketing Check

We will review your cookie banner, tracking tags, forms, consent wording and supplier set-up against the Data Protection Act 2018, UK GDPR and PECR as amended in 2026, and send you a prioritised fix list. No obligation, no personal data needed.

Email chennareddy819@gmail.com WhatsApp +91 9505971747

Replies within one UK business day · Calls on Zoom, Google Meet or Teams at UK-friendly times

About the Author and Sources

Chenna Reddy is the founder of Digital Masters 360, a Hyderabad-based digital marketing agency that delivers SEO, content, paid media and analytics 100% online to clients in the UK, US, Canada, Australia and other Tier 1 markets. He builds privacy-first tracking and consent set-ups for UK clients.

Disclaimer: This guide is general information, not legal advice. It reflects UK law and guidance as at 5 October 2026. For decisions about your organisation, take advice from a qualified UK data protection lawyer or adviser.