UK GDPR vs EU GDPR: the differences that reach your website

UK GDPR and EU GDPR are still close to the same law, with five differences that matter to a website since the Data (Use and Access) Act 2025 took effect: cookies for analytics, recognised legitimate interests, automated decisions, subject access searches and a duty to handle complaints yourself. The core, from lawful bases to breach notices, is unchanged on both sides.

The UK GDPR is the EU regulation as it stood on 31 December 2020, kept in UK law after Brexit and read together with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). The Data (Use and Access) Act 2025 (DUAA) amended all three. It received Royal Assent on 19 June 2025; most of its data protection changes came into force on 5 February 2026, and the last ones, including the complaints duty, on 19 June 2026.

The EU did not follow. Its GDPR is the same text it was in 2018, applied by 27 national authorities, with cookies still governed by the ePrivacy Directive as each member state wrote it into law. A business with customers in London and in Lyon now answers to two versions of the same idea.

Does GDPR still apply in the UK after Brexit?

Yes, in two ways. The UK GDPR applies to organisations in the UK and to organisations outside it that offer goods or services to people in the UK or monitor their behaviour. And the EU GDPR still applies to a UK business that offers goods or services to people in the EU or monitors them, for instance with analytics or advertising tags on a site that sells to Ireland or Germany. Article 3(2) of the EU GDPR does not care where you are based. US companies face the same test; see GDPR for US companies.

That is the first practical point for a UK site: if you sell to EU consumers, you are inside the EU GDPR for that part of your business, and you may need a representative in the EU (more on that below).

Five differences that reach a website

The DUAA also changed rules that rarely touch a commercial website: research and archiving, sharing with the police without assessing their task, charities' soft opt-in for email, and new powers for the regulator, which is moving from the Information Commissioner's Office to an Information Commission. Fines did not change in size: up to 17.5 million pounds or 4 percent of worldwide turnover in the UK, against 20 million euros or 4 percent in the EU. Under PECR, though, the ceiling rose from 500,000 pounds to the UK GDPR level, which matters for cookies and marketing email; see UK cookie law.

Data from the EU to the UK: adequacy until 2031

On 19 December 2025 the European Commission renewed both of its UK adequacy decisions, one under the GDPR and one under the Law Enforcement Directive. They now run until 27 December 2031, with a review after four years. The European Data Protection Board gave its opinion on 16 October 2025, and the Commission had first extended the old decisions by six months in June 2025 to assess the DUAA.

In practice: an EU company may send personal data to a UK supplier, hosting provider or sister company without standard contractual clauses or a transfer impact assessment. For a UK business serving EU clients, that removes a hurdle in every sales conversation. The Commission can suspend or amend adequacy if UK law drifts too far, so keep an eye on it before 2031.

The other direction is UK law. The UK keeps its own list of adequate countries, which includes the EU and the EEA, so data flows from the UK to the EU freely too. For transfers to other countries the DUAA rewrote the test: the UK now asks whether protection is not materially lower than in the UK, the data protection test, instead of essentially equivalent.

Where the data sits and who can reach it is a separate question from whether it may go there; see EU data residency.

Representatives on both sides

Article 27 of the EU GDPR asks a business outside the EU that offers goods or services to people in the EU, or monitors them, to appoint a representative in a member state where those people are. A UK online shop selling to Ireland and France therefore needs one, unless its processing is occasional, does not involve special category data on a large scale and is unlikely to put people at risk. The UK has the mirror rule: an EU or US business targeting people in the UK names a UK representative.

The representative is a point of contact for regulators and individuals, named in your privacy notice. Specialised firms offer it as a service; a lawyer can tell you whether your processing falls under the exception.

One privacy notice or two

A site that serves both markets does not need two privacy notices, but the one it has must hold both regimes:

• the lawful basis per purpose, with the EU balancing test documented even where the UK no longer asks for it;
• the UK complaints route, which is now a legal duty, alongside the right to complain to the ICO and to the EU authority where the visitor lives;
• your EU representative, if you need one, and your UK representative if you are based in the EU;
• the cookies and tags per country, if your banner behaves differently for UK and EU visitors;
• the transfers, with the basis for each, from the table above.

What a privacy notice is and when you need one is answered in do I need a privacy policy.

Which standard to build to

• Choose the EU standard everywhere ifa meaningful share of your visitors or customers is in the EU, or you plan to sell there. One banner, one notice, one set of forms: simpler to build and to test, at the cost of some UK analytics data.
• Choose a split by country ifalmost all your audience is in the UK and the data you would gain from the lighter UK cookie rules really changes decisions. Budget for building and testing the country logic, and document it.
• Choose the UK standard alone only ifyou do not offer anything to people in the EU and do not monitor them. A UK-only service with a UK-only audience can take the lighter rules as they come.

For most businesses we work with, the first answer wins. The exception is analytics: a UK-heavy site can measure UK visitors without a consent banner and keep EU visitors behind one, which is worth the build when marketing depends on the numbers.