UK GDPR & Data Protection Act 2018

On 1 January 2021 the EU GDPR ceased to apply in the UK and was replaced by the 'UK GDPR' — the retained EU regulation with technical amendments made by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. The Data Protection Act 2018 provides the operational framework around the UK GDPR: it covers law-enforcement processing (Part 3), intelligence-services processing (Part 4), the Information Commissioner's Office (ICO) powers and penalties, and specific derogations and exemptions.

The UK GDPR is substantively identical to the EU GDPR as a baseline, with divergences introduced through subsequent legislation (the Data Protection and Digital Information Bill and its successors) and ICO guidance. Transfers between the UK and the EEA flow under mutual adequacy decisions (UK → EEA under the European Commission's 2021 adequacy decision for the UK, which was renewed in 2025). The ICO is the sole UK supervisory authority, replacing the EDPB consistency mechanism with its own national regime.