The UK GDPR is the UK’s own retained version of the GDPR, kept separate from the EU regulation since Brexit and now updated by the Data Use and Access Act 2025, which tweaks rather than rewrites the automated decision-making rules. Meanwhile, the European Commission’s renewed adequacy decisions mean personal data can keep flowing between the UK and the EEA without extra paperwork, at least for now.
TL;DR:
- UK rules now permit any lawful basis for significant automated decisions, but require human intervention, challenge rights, and added safeguards for sensitive data.
- Map processing activity by activity: a UK business targeting EU customers may face EU GDPR, depending on its establishment and customers’ location.
- Routine UK to EEA transfers need no Standard Contractual Clauses for now, but the four year review and 2031 expiry warrant contingency plans.
- PECR generally sets stricter consent rules for UK marketing; its soft opt in covers similar products only if customers received an opt out at collection.
- Review cross border contracts and impact assessments for wording that assumes one GDPR text, and record the lawful basis and safeguards for each automated system.
Digistrat
Support compliant email deliverability
Digistrat assesses sender reputation, email infrastructure and list quality to help UK and European businesses address deliverability issues.
Explore deliverability support
Table of Contents
- 1. Key differences between UK GDPR and EU GDPR
- 2. What the Data Use and Access Act 2025 changes in practice
- 3. Data transfers and adequacy: what the EU renewal means for cross-Channel flows
- 4. Practical compliance steps for organisations working across the UK and EEA
- 5. PECR and ePrivacy: the rules that sit alongside UK GDPR
- 6. Applying data protection rules to email deliverability and marketing
- 7. A short checklist for dual UK and EEA compliance
- 8. Getting deliverability right while staying compliant
- FAQ
- Sources
1. Key differences between UK GDPR and EU GDPR
The two regimes started life as identical twins. The UK GDPR was created when the EU GDPR was copied into domestic law at the end of the Brexit transition period, so for several years the text was nearly word for word the same, just wearing a different passport. That is no longer quite true, and the gap is widening in specific, practical ways rather than wholesale rewriting.
The first and most basic difference is legal form. EU GDPR is a regulation that applies directly across the EEA, enforced by national supervisory authorities working under a shared framework. UK GDPR is retained domestic law, sitting alongside the Data Protection Act 2018, and it answers only to UK courts and the Information Commissioner’s Office. That distinction matters because amendments to one do not automatically touch the other: a change made in Brussels has no effect on UK law, and a change made in Westminster has no effect on the EU text.
The second difference is the pace and direction of reform. The EU has largely left its core GDPR text untouched since 2018, while the UK has now legislated changes through the Data Use and Access Act 2025, most notably around automated decision-making and the lawful bases that support it.
Several practical points follow from this divergence:
- Organisations operating only in the UK answer solely to the ICO and UK statute, while EU-only operations fall under their local supervisory authority and the unchanged EU text.
- Businesses trading across both jurisdictions must track two sets of guidance, since ICO and EDPB positions can diverge on the same question.
- Contracts referencing “the GDPR” without specifying which version now carry real ambiguity and are worth revisiting.
- Controllers and processors operating cross-Channel need to confirm which law governs each specific processing activity, not assume one covers both.
For most day-to-day compliance work, the practical effect has so far been modest. The principles, the rights, and the core obligations remain closely aligned. The differences that do exist are concentrated, and the next section covers the biggest one.
2. What the Data Use and Access Act 2025 changes in practice
The headline change under the Data Use and Access Act 2025 concerns solely automated decision-making, an area that previously sat under a single, fairly restrictive Article 22. The DUAA guidance confirms that this has been replaced with a more detailed framework spread across Articles 22A to 22D, which permits automated decisions under any lawful basis provided the right safeguards are in place.
The practical shift breaks down into four parts:
- Organisations can now rely on any lawful basis, not just consent or contract, to justify solely automated decisions that have legal or similarly significant effects on someone.
- Article 22C requires specific safeguards, including the right to obtain human intervention, to contest the decision and to express a view before it is acted on.
- Special category data still attracts tighter restrictions, so automated decisions touching health, biometric or similar data need extra justification beyond the general Article 22A to 22D framework.
- The reforms apply going forward from commencement, with transitional provisions preserving the old rules for decisions, requests and complaints that predate the new commencement dates.
It is worth being precise instead: the ICO’s own framing is that the DUAA amends the UK GDPR, the Data Protection Act 2018 and PECR, rather than replacing any of them. That single sentence from the regulator is the most useful anchor for compliance teams trying to work out how much has actually changed: the underlying obligations to protect data, document decisions and respect individual rights have not gone anywhere.
For teams running automated scoring, eligibility checks or marketing segmentation that previously relied on consent to satisfy Article 22, this is worth revisiting now. The new flexibility on lawful basis is genuinely useful, but only once the human intervention safeguard and supporting documentation are actually built, not assumed.
3. Data transfers and adequacy: what the EU renewal means for cross-Channel flows
An adequacy decision is the EU’s way of saying a country’s data protection standards are good enough that personal data can move there without extra contractual machinery such as Standard Contractual Clauses. For UK businesses handling EEA customer or employee data, and EU businesses sending data to UK processors, this has quietly underpinned a huge amount of ordinary commercial activity since 2021.
The European Commission’s renewal, confirmed on 19 December 2025, keeps that arrangement alive. It carries a sunset clause running to 27 December 2031, with a review checkpoint after four years, so the decision is not indefinite and is explicitly tied to continued confidence in UK standards. The Commission reached this view after an EDPB opinion and agreement from Member States, which gives the renewal more weight than a routine administrative extension.
In practice, this means:
- Routine transfers of customer, employee and marketing data between UK and EEA entities can continue without Standard Contractual Clauses for now.
- Group companies and processors operating across both jurisdictions do not need to rebuild their transfer mechanisms purely because of Brexit.
- The 2031 sunset clause and four-year review mean contingency planning is still sensible, particularly for data flows that would be expensive to unwind quickly.
- Any future UK reform that diverges significantly from EU standards, including further changes under the DUAA, could affect the next adequacy review.
Organisations that rely heavily on cross-Channel data should keep half an eye on the European Commission’s adequacy pages rather than assuming the current arrangement is permanent. A calendar reminder ahead of the review checkpoint is a sensible, low-effort safeguard.
4. Practical compliance steps for organisations working across the UK and EEA
Translating the legal differences into daily practice starts with a jurisdictional test: which law actually governs a given piece of processing. Broadly, this depends on where the organisation processing the data is established and where the people whose data is being processed are located, not simply where the company’s head office sits. A UK retailer targeting EU customers can find itself subject to EU GDPR for that activity even though its own compliance programme is built around UK GDPR.
Once that question is answered for each major processing activity, several practical tasks follow:
- Map lawful bases activity by activity, since a basis that works comfortably under UK GDPR’s revised automated decision-making rules may need separate justification under the unchanged EU text.
- Update Data Protection Impact Assessments to reflect the Article 22A to 22D framework where automated decisions are in use, documenting the safeguards rather than just the outcome.
- Review subject access request handling and internal record-keeping so that both ICO and EU supervisory authority expectations are met without running two entirely separate processes.
- Check processor and controller contracts for clauses that assume a single, shared GDPR text, and amend wording that no longer reflects the UK’s amended position.
Pro Tip: Keep a short, dated log of which lawful basis and safeguard applies to each automated decision system, since that evidence is exactly what regulators ask for first.
Contract review deserves particular attention. Data processing agreements drafted before the DUAA often reference obligations in terms that assumed only one version of the GDPR existed, and the standard 72-hour breach notification language is a common sticking point. Separate analysis of breach reporting clauses highlights how rigid drafting here can create compliance traps that have nothing to do with the substance of the breach itself, simply the wording of the clock. Reviewing these clauses alongside the jurisdictional mapping exercise saves a second pass later.
5. PECR and ePrivacy: the rules that sit alongside UK GDPR
Anyone sending marketing email or using cookies in the UK needs to think about two regimes at once, because the Privacy and Electronic Communications Regulations work alongside, not instead of, the UK GDPR. The ICO’s PECR guidance is clear that complying with PECR supports but does not replace broader data protection obligations.
PECR sets specific rules that general data protection law does not, and they tend to be the rules that actually determine whether a marketing campaign is lawful:
- Consent standards for electronic marketing under PECR are generally stricter than the general UK GDPR consent bar, particularly for unsolicited email and SMS.
- The soft opt-in exemption allows marketing to existing customers about similar products without fresh consent, provided a clear opt-out was offered at the point of collection, which our guide to PECR soft opt-in sets out in more detail.
- Cookie and similar technology rules under PECR require consent before non-essential cookies load, independently of whatever lawful basis underpins other processing on the same site.
- Network and service providers have specific carve-outs under Article 95 of the UK GDPR, since PECR already governs their position on electronic communications data.
The EU’s proposed ePrivacy Regulation, intended to eventually replace the EU’s own ePrivacy Directive, has no bearing on the UK regime at all. PECR will keep applying in the UK regardless of how that EU legislative process concludes, so UK senders should treat any EU ePrivacy headline as background noise rather than something requiring a UK policy change.
6. Applying data protection rules to email deliverability and marketing
Data protection compliance and email deliverability are more closely linked than most marketing teams assume, because the technical signals that protect your sender reputation are often the same evidence a regulator would ask for. A clean, consent-based list behaves differently in an inbox provider’s eyes than a bought or scraped one, and that difference shows up in spam placement long before it shows up in a complaint to the ICO.
A few checks worth running together:
- Confirm SPF, DKIM and DMARC are correctly aligned across every domain and subdomain sending marketing or transactional mail, since misconfigured authentication both weakens deliverability and undermines any claim that your sending practices are secure and accountable.
- Document consent capture at the point of collection, including whether soft opt-in applies, so the same record that satisfies PECR also demonstrates list hygiene to an email service provider investigating complaints.
- Monitor IP and domain reputation on an ongoing basis rather than only after a deliverability problem appears, since reputation decline is usually gradual and easier to fix early.
- Ask vendors and internal stakeholders for evidence of list source, consent basis and bounce handling before adding any third-party list to a sending programme.
Pro Tip: A bounce rate creeping upward is often the first external sign of a consent or list hygiene problem long before any regulatory complaint arrives.
We work specifically on the technical side of this overlap, reviewing SPF, DKIM, DMARC configuration, IP reputation and list quality for senders, and our DMARC implementation plan sets out a practical 90-day approach for teams starting from scratch.
7. A short checklist for dual UK and EEA compliance
Turning all of the above into an ordered set of actions makes the difference between understanding the rules and actually reducing risk. The following sequence works for most teams handling data on both sides of the Channel.
- Map every processing activity against the jurisdictional test, confirming which law, UK GDPR or EU GDPR, governs each one rather than assuming a single blanket answer.
- Check reliance on EU-UK data transfers against the renewed adequacy decision, noting any flows that would need Standard Contractual Clauses if the decision were not in place.
- Update controller and processor contracts to reflect the amended UK position, particularly around automated decision-making and breach notification timelines.
- Revisit Data Protection Impact Assessments for any system making solely automated decisions, documenting the Article 22A to 22D safeguards explicitly.
- Audit marketing consent records against PECR’s soft opt-in and explicit consent standards, separately from general UK GDPR lawful basis documentation.
- Align incident response procedures so a single breach can be reported correctly to both the ICO and any relevant EU supervisory authority without duplicating effort.
- Set a review date tied to the adequacy decision’s four-year checkpoint and the 2031 sunset clause, so contingency planning does not get forgotten.
- Bring in external advisers where the automated decision-making safeguards or cross-border contract wording raise genuine legal uncertainty, asking specifically for a written safeguard assessment rather than a general opinion.
Teams managing their own email infrastructure may also find value in reviewing patterns used elsewhere in regulated sectors, and examples of compliant email automation for professional firms illustrate how consent and automation requirements can sit comfortably together in practice.
8. Getting deliverability right while staying compliant
Getting the legal side right matters less if your emails are quietly landing in spam, and that is the gap we focus on closing for UK and European senders. Our work starts with a clear-eyed look at sender reputation, authentication and list quality, then moves to fixing the specific technical issues holding your inbox placement back.
A typical first engagement looks at where your current setup falls short, whether that is SPF and DKIM misalignment, an IP reputation problem, or a list that has drifted away from clean consent records, and then sets out exactly what needs fixing and in what order.
- A free health check gives a starting view of current sending health.
- A deliverability review and fix addresses authentication, reputation and list quality issues directly rather than just reporting them.
- Reputation monitoring keeps watch on sender health after the initial fix.
- Authentication setup covers SPF, DKIM and DMARC configuration for teams migrating ESPs or starting from scratch.
| Service | What it covers |
|---|---|
| Free health check | Initial review of current sending health |
| Deliverability Review and Fix | Authentication, reputation and list quality remediation |
| Authentication setup | SPF, DKIM, DMARC configuration |
| Reputation recovery | Restoring sender standing after a deliverability problem |
For a deeper, structured assessment, our email deliverability audit is a practical starting point, and teams wanting direct advice can book a paid advisory session at £250 one-off to work through specific issues with a senior specialist.
FAQ
Is the UK under GDPR?
Yes, the UK operates under UK GDPR, its own retained version of the GDPR that sits alongside the Data Protection Act 2018. It is enforced by the Information Commissioner’s Office and has been amended by the Data Use and Access Act 2025, rather than replaced by it.
Is GDPR changing in 2026?
The EU GDPR text itself has not changed, but UK GDPR has been reshaped by the Data Use and Access Act 2025, with commencement and transitional provisions set out in a 2026 statutory instrument. These changes mainly affect automated decision-making rules rather than the core principles of data protection.
What are the 7 GDPR requirements?
GDPR, in both its UK and EU forms, is generally understood around core principles including lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Both UK GDPR and EU GDPR apply these principles in close alignment, with the main current divergence sitting in the UK’s amended automated decision-making framework rather than these foundational requirements.
What is the difference between the EU and the UK on data protection?
The core difference is legal form and oversight: EU GDPR is an EU regulation enforced by national supervisory authorities across the EEA, while UK GDPR is UK domestic law enforced solely by the ICO. The UK has since amended its version through the Data Use and Access Act 2025, while the EU text has remained unchanged, and the two remain linked by the European Commission’s renewed adequacy decision permitting continued data flows between them.
Sources
- Data use and access Act 2025: data protection and privacy changes
- The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations?
- Commission renews decisions to allow for the free and safe flow of personal data with the UK
- UK statutory instrument: commencement and transitional provisions relating to DUAA
- What are PECR? | ICO
