europe
United Kingdom
The UK GDPR and Data Protection Act 2018 largely mirror EU concepts with domestic oversight.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
high confidence, Strong coverage base. Needs continued tracking of reform and regulator guidance updates.
At a glance
Key presentation points
A compact summary of high-signal fields before the full structured record.
Structured record
Regulation details grouped by topic
Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.
Identity
- Effective status
- in-forceSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Law status
- activeSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Effective date
- 2021-01-01Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Last amended
- 2024-10-24Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Scope
- Extraterritorial application
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Territorial scope
- Applies in the UK and extraterritorially to certain overseas processing targeting UK individuals.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Private sector coverage
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Public sector coverage
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Definitions
- Personal data definition
- Information relating to an identified or identifiable living individual.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Sensitive data recognized
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Legal Basis
- Legal bases
- consent, contract, legal obligation, vital interests, public task, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Requires legal basis
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Rights
- Right of access
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to deletion
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to object
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to portability
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to appeal
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to erasure or delete summary
- Erasure right with exceptionsSupport: 1 primary • Reviewed 17/04/2026Sources: UK legislation text (primary)Note: The UK retains GDPR-style erasure terminology and structure.
- Right to rectification or correction summary
- Rectification rightSupport: 1 primary • Reviewed 17/04/2026Sources: UK legislation text (primary)Note: The UK retains GDPR-style rectification terminology.
Breach
- Breach deadline (hours)
- 72Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Breach notification required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Governance
- DPO required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Impact assessment required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Records of processing required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Enforcement
- Maximum fine
- Up to £17.5 million or 4% of worldwide annual turnover.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Private right of action
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Regulator or enforcement authority summary
- Information Commissioner's OfficeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: UK GDPR text (primary); ICO guide to data protection (secondary)Note: UK GDPR/DPA enforcement is centered on the ICO, supported by the retained UK GDPR text and ICO guidance.
Transfers
- Cross-border transfer restricted
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
- Data localization required
- NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Marketing
- Cookie consent rule
- PECR generally requires consent for non-essential cookies.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: UK legislation text (primary); ICO guide to data protection (secondary)Note: Starter MVP editorial summary based on official source set.
Official sources
- UK GDPR textPrimary official law • en • html
- UK legislation textPrimary official law • en • html
- ICO guide to data protectionSecondary official material • en • html
Recent change workflow
- PECR consent plus stronger refusal UX emphasispending • extractor openclaw