If you sell into both the UK and the EU, you are subject to two data protection regimes that started as the same text. For several years after Brexit, the practical differences were mostly administrative. That is no longer quite true. The UK has started to amend its version, and the two will keep drifting.
The good news is that most of your program carries across unchanged. Lawful bases, transparency, individual rights, security, breach notification and records of processing work the same way in both. The differences sit in a smaller set of places: who regulates you, who represents you, how you document transfers, and a set of UK reforms.
This article covers those differences, so you can run one program with a short list of UK-specific and EU-specific items rather than two programs.
Where the UK GDPR comes from
When the UK left the EU, it kept the GDPR in domestic law, amended so that it works in a UK-only context. That retained text is the UK GDPR. It sits alongside the Data Protection Act 2018, which fills in the details that the GDPR left to member states, such as exemptions and the age of consent for online services.
The UK has since passed the Data (Use and Access) Act 2025, which received Royal Assent in June 2025. It amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. Its provisions were brought into force in stages rather than all at once, so check which ones apply on the date you are assessing.
The EU GDPR, meanwhile, continues to be interpreted by the European Data Protection Board and the Court of Justice of the EU. UK courts and the UK regulator are no longer bound by new EU case law, though it remains influential.
The differences that matter in practice
| Topic | EU GDPR | UK GDPR |
|---|---|---|
| Regulator | National supervisory authorities, with a lead authority for cross-border processing | The UK regulator, historically the Information Commissioner's Office |
| One-stop shop | Available if you have a main establishment in the EU | Not available; the UK regulator is separate |
| Representative for non-established companies | EU representative under Article 27 | UK representative under UK GDPR Article 27 |
| Standard transfer contract | European Commission standard contractual clauses | International Data Transfer Agreement, or the UK Addendum to the EU clauses |
| Transfer risk documentation | Transfer impact assessment | Transfer risk assessment |
| Transfers to the US | EU-US Data Privacy Framework | UK Extension to the EU-US Data Privacy Framework |
| Age of consent for online services | 16 by default; member states may set it as low as 13 | 13 |
| Recent reform | No equivalent reform to the core text | Data (Use and Access) Act 2025 |
Regulators and the one-stop shop
Under the EU GDPR, a company with a main establishment in the EU deals with one lead supervisory authority for cross-border processing. That mechanism never covered the UK. If you have establishments in both, you deal with the UK regulator for UK processing and with your EU lead authority for EU processing. A breach affecting people in both may need to be notified to both, each within 72 hours where the threshold is met.
The Data (Use and Access) Act also restructures the Information Commissioner's Office into a corporate body, the Information Commission. Check the current name on any notice or template you send.
Representatives
A company with no establishment in the EU that offers goods or services to people in the EU, or monitors their behavior, generally needs an EU representative. The UK GDPR has the mirror-image rule. A US company selling into both regions may need two representatives, one in the UK and one in an EU member state. Both rules have limited exceptions for occasional, low-risk processing.
International transfers
The UK runs its own transfer regime. The UK recognizes the EEA as adequate, so UK-to-EU transfers flow freely. EU-to-UK transfers rely on the European Commission's adequacy decision for the UK. That decision was time-limited when first adopted in 2021 and has been under review in light of the UK reforms, so confirm its current status before relying on it.
For transfers to other countries, the UK uses its own tools. You can use the International Data Transfer Agreement, or attach the UK Addendum to the EU standard contractual clauses. Most companies with existing EU clauses choose the Addendum, because it keeps one contract structure. The UK equivalent of a transfer impact assessment is a transfer risk assessment, and the UK regulator publishes its own guidance and tool for it. For the EU side, see standard contractual clauses for international transfers.
For US recipients, the UK Extension to the EU-US Data Privacy Framework allows transfers to US organizations that have opted into the UK Extension as part of their certification. An organization certified only for EU data is not automatically covered for UK data.
What the Data (Use and Access) Act 2025 changed
The Act is a set of amendments, not a rewrite. The changes most relevant to a SaaS company are these, described in general terms:
Recognized legitimate interests. A defined list of purposes, such as national security, emergencies, safeguarding and crime prevention, for which the legitimate interests balancing test is not required.
Automated decision-making. The UK rules on solely automated decisions with significant effects were restructured. They now allow such decisions on a wider range of lawful bases, subject to safeguards, with stricter limits where special category data is involved.
Subject access requests. The Act puts on a statutory footing that searches need to be reasonable and proportionate, and it clarifies when the response clock can be paused while you seek clarification.
Complaints. Controllers must have a process for handling data protection complaints from individuals.
International transfers. The test for UK adequacy is framed as whether the standard of protection in the other country is not materially lower than in the UK.
Cookies and electronic marketing. Some low-risk cookies and similar technologies can be used without consent, and fines under the electronic communications rules were aligned with UK GDPR levels.
None of these changes the EU GDPR. A practice that relies on a UK relaxation, such as using a cookie without consent, may still need consent for EU users. Where the two regimes now differ on a specific practice, confirm the position with counsel rather than applying the more relaxed rule everywhere.
What stays the same, and how to run one program
Most of the work does not change between the regimes:
Lawful bases and the six options in Article 6
Transparency requirements in Articles 13 and 14
Records of processing under Article 30
Data processing agreements under Article 28
Data protection impact assessments for high-risk processing
Breach notification to the regulator within 72 hours, where required
Fines in two tiers, with the UK's caps set in sterling
The efficient approach is one privacy program with jurisdiction flags. In practice:
Write one privacy notice that names both regimes and lists the UK-specific and EU-specific details, such as representatives and regulators.
Use one data processing agreement that covers both, with the UK Addendum attached to the EU clauses.
Keep one record of processing, with a field showing which regime applies to each activity.
Keep one incident process that asks, at triage, which regulators need to be told.
Track the divergences in a short register, reviewed when either side changes its rules.
The register in step five matters more each year. Divergence will continue on both sides, so a list of where they differ is easier to maintain than two sets of documents. If you are a US company working out your exposure to both, GDPR for US SaaS companies covers the territorial scope questions. The GDPR framework page summarizes the core obligations both regimes share.
How TrustLynce helps
TrustLynce maps one set of controls across frameworks, so UK and EU obligations that share a requirement share the evidence; see compliance automation. Records of processing, DPIAs and transfer assessments are kept in data privacy workflows.