Contents Knowledge map

Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

United Kingdom

Open in Knowledge map

Sources last checked:

The United Kingdom kept its own version of the GDPR after leaving the EU, the UK GDPR, alongside the Data Protection Act 2018. The Data (Use and Access) Act 2025 changed both, and most of its data protection changes took effect on 5 February 2026.1

At a glance

Question Answer
Main laws UK GDPR, Data Protection Act 2018, and the rules on cookies and marketing (PECR)
Report a breach to the regulator Within 72 hours where feasible, unless unlikely to create a risk2
Age to consent online alone 133
Highest fine £17.5 million or 4% of worldwide annual turnover, whichever is higher4

Who it protects and who must comply

As in the EU, it applies to organisations established in the UK, wherever the processing happens, and to organisations elsewhere that offer goods or services to people in the UK, or monitor their behaviour there.5

Your rights

You can get access to your data,6 have it erased in the cases the law lists,7 restrict its use,8 move it to another service9 and object to some uses.10 You can complain to the regulator11 and claim compensation for damage.12

The 2025 Act replaced the EU-style rule on automated decisions. A significant decision made solely by a machine must now come with safeguards, including information about the decision.13

When data is breached

A breach must be reported to the regulator without undue delay and, where feasible, within 72 hours, unless it is unlikely to create a risk to people.2

Cookies and similar technology

A separate set of rules, PECR, forbids storing information on a person’s device or reading it, unless an exception in the rules applies.14 This was rewritten by the 2025 Act, which also raised the maximum fine under these rules to £17.5 million or 4% of global turnover.15

Sending data abroad

A transfer needs approval by regulations, or appropriate safeguards.16

Fines

The higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. The standard maximum is £8.7 million or 2%.4

References

  1. UK Government: Data (Use and Access) Act 2025, plans for commencement ↩

  2. UK GDPR, Article 33: Notification of a breach ↩ ↩2

  3. UK GDPR, Article 8: Child’s consent ↩

  4. Data Protection Act 2018, section 157: Maximum amount of penalty ↩ ↩2

  5. UK GDPR, Article 3: Territorial scope ↩

  6. UK GDPR, Article 15: Right of access ↩

  7. UK GDPR, Article 17: Right to erasure ↩

  8. UK GDPR, Article 18: Right to restriction of processing ↩

  9. UK GDPR, Article 20: Right to data portability ↩

  10. UK GDPR, Article 21: Right to object ↩

  11. UK GDPR, Article 77: Right to lodge a complaint ↩

  12. UK GDPR, Article 82: Right to compensation ↩

  13. UK GDPR, Article 22C: Safeguards for automated decision-making ↩

  14. PECR 2003, regulation 6: Storing information in terminal equipment ↩

  15. Information Commissioner’s Office: statement on the commencement of the 2025 Act ↩

  16. UK GDPR, Article 44A: General principles for transfers ↩