Yes, though they started out the same. The UK GDPR is the EU GDPR as it stood when the UK left the EU at 11pm on 31 December 2020, adapted for the UK and amended since, most recently by the Data (Use and Access) Act 2025. The core principles and rights are the same, but the UK version now has differences, such as a seventh lawful basis for "recognised legitimate interests". The UK GDPR sits alongside the Data Protection Act 2018, and the EU has renewed its adequacy decision for the UK until 27 December 2031. The Lift College GDPR Training course covers the UK rules and the recent changes.
How the UK GDPR came about
The EU GDPR, Regulation (EU) 2016/679, applied from 25 May 2018. When the UK left the EU, the UK kept it as UK law. legislation.gov.uk publishes the UK version, kept up to date with UK amendments; EUR-Lex publishes the EU version.
What stays the same
- the seven principles in Article 5
- the need for a lawful basis
- extra protection for special category data
- people's rights over their data
- the highest fines: up to £17.5 million, or 4% of worldwide annual turnover, whichever is higher
What is different
- Lawful bases: since the Data (Use and Access) Act 2025, the UK GDPR has seven lawful bases. The new one, recognised legitimate interest, covers pre-approved purposes such as safeguarding vulnerable people, responding to emergencies and preventing crime.
- Regulator: in the UK it is the Information Commission, which replaced the Information Commissioner on 30 September 2026.
- Who it applies to: the UK GDPR covers organisations established in the UK, and those outside the UK that offer goods or services to, or monitor, people in the UK.
- Other changes in the 2025 Act, which the government's factsheet lists, include clearer rules for using data for research.
Which act sits alongside the UK GDPR?
The Data Protection Act 2018. Section 1 says most processing of personal data is subject to the UK GDPR, and Part 2 of the Act supplements it. Other parts of the Act cover law enforcement and the intelligence services.
EU adequacy
The ICO says the European Commission renewed its adequacy decisions for the UK on 19 December 2025. They let personal data flow from the EEA to the UK without extra safeguards, and last until 27 December 2031.
Do UK organisations need to follow both?
A UK organisation that operates in the EEA, targets customers there or monitors people's behaviour there may also need to follow the EU GDPR, as the ICO explains.
Training
Lift College GDPR Training is 2 hours in 5 modules, including a module on people's rights and recent changes, with a CPD Standards Office accredited certificate the same day you pass.
Frequently asked questions
Is there a difference between UK GDPR and EU GDPR?
What is UK GDPR?
UK GDPR sits alongside which act?
Who is responsible for enforcing the UK GDPR?
Can personal data still flow from the EU to the UK?
Do UK businesses need to comply with the EU GDPR?
Sources checked
- legislation.gov.uk: UK GDPR (checked 13 November 2026)
- legislation.gov.uk: UK GDPR, article 3 (checked 13 November 2026)
- legislation.gov.uk: GDPR as adopted, article 99 (checked 13 November 2026)
- legislation.gov.uk: Data Protection Act 2018, section 1 (checked 13 November 2026)
- ICO: Receiving personal information from the EEA (checked 13 November 2026)
- ICO: A guide to lawful basis (checked 13 November 2026)
- ICO: The Information Commission (Data (Use and Access) Act 2025) (checked 13 November 2026)
- GOV.UK: Data (Use and Access) Act factsheet, UK GDPR and DPA (checked 13 November 2026)
- Lift College: GDPR Training (checked 13 November 2026)