Two regimes, one family
EU GDPR applies to organisations that offer goods or services to people in the EU or monitor their behaviour, wherever the organisation is based. UK GDPR, together with the Data Protection Act 2018, is the UK's version of the same law. It was retained in UK law after Brexit and is supervised by the ICO.
The core principles, lawful bases, individual rights, breach notification duties and impact assessments are largely the same. Maximum fines follow the same structure in both: up to 4% of global annual turnover, or a fixed cap, whichever is higher.
Where they differ
- Regulators: the ICO in the UK, and national supervisory authorities in each EU member state.
- International transfers: each regime has its own transfer rules and safeguards. Transfers between the UK and the EU currently rely on adequacy arrangements, so check their current status.
- Evolving UK law: the UK continues to amend its framework, for example through the Data (Use and Access) Act 2025, so the two regimes can drift over time.
- Representatives: organisations outside the UK or EU that are subject to the rules may need a representative in each jurisdiction.
Do you need to comply with both?
If you offer goods or services to people in both the UK and the EU, or monitor their behaviour, generally yes. A single well-built privacy programme can cover both, with a few jurisdiction-specific items such as transfer mechanisms, representatives and supervisory-authority contacts. Confirm your exact position with legal counsel.
A practical checklist
- Map your personal-data processing and note which people and countries are involved.
- Keep a record of processing activities and identify a lawful basis for each activity.
- Update privacy notices and data processing agreements with processors.
- Document your international transfers and the safeguard for each.
- Decide whether you need a data protection officer and a UK or EU representative.
- Prepare breach response and individual-rights request procedures.
What about certification?
There is no single official GDPR certificate. ISO 27701 gives you a certifiable privacy management system mapped to GDPR, and ISO 27001 covers the security side. See our ISO 27701 page and ISO 27001 page.
Documents to write once and use twice
You do not need two compliance programmes. Most of the paperwork can serve both regimes if you build it with both in mind:
- One record of processing activities, with a column for the legal basis and the transfer route.
- One privacy notice with sections for UK and EU readers where the rules differ.
- Data processing agreements that name the right transfer mechanism for each direction.
- One procedure for handling requests from individuals about their data.
- One breach register and one incident playbook that lists each regulator you may need to contact and how.
Which regime applies to which customer, and which transfer route fits, depends on your own facts, so confirm the details with a qualified adviser. Our gap diagnostic is a quick way to see which of these documents you already have.
Next step
Tell us where your customers are and what data you process, and we will outline the work. See our GDPR page, or book a free advisory session. This article is general information, not legal advice.
