GDPR stands for General Data Protection Regulation: the law on how organisations collect, use, store and share personal data. The EU GDPR applied from 25 May 2018. Since the UK left the EU, the UK has its own version, the UK GDPR, which works alongside the Data Protection Act 2018 and was amended by the Data (Use and Access) Act 2025. It sets seven principles for handling personal data, gives people rights over their data, and allows fines of up to £17.5 million or 4% of worldwide turnover, whichever is higher. The Lift College GDPR Training course covers what staff need to know.
What GDPR stands for
General Data Protection Regulation. It is Regulation (EU) 2016/679. Article 99 says it applied from 25 May 2018.
What the UK GDPR is
When the UK left the EU, the GDPR was kept in UK law as the UK GDPR, as it stood at 11pm on 31 December 2020, and the UK has amended it since. Section 1 of the Data Protection Act 2018 says most processing of personal data is subject to the UK GDPR, and Part 2 of the Act supplements it.
What it covers
The UK GDPR applies to the automated or structured processing of personal data: information that relates to an identified or identifiable person, such as a name, an ID number, an IP address or a cookie identifier. It does not apply to processing by an individual for purely personal or household activities.
What it requires
- Seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.
- A lawful basis: organisations must have one of seven lawful bases before they use personal data, and document it.
- Extra care with special category data, such as health or ethnic origin, which needs a lawful basis and an additional condition.
- People's rights over their data, such as erasure when it is no longer needed.
Who enforces it
The UK regulator is the Information Commission, which replaced the Information Commissioner on 30 September 2026 under the Data (Use and Access) Act 2025. Its guidance is still at ico.org.uk. The ICO's guidance says breaking the basic principles can bring the highest tier of fine: up to £17.5 million, or 4% of total worldwide annual turnover, whichever is higher.
What changed recently
The Data (Use and Access) Act 2025 amended the UK GDPR and the Data Protection Act 2018 in stages. For example, it added a seventh lawful basis, recognised legitimate interests, and replaced the Information Commissioner with the Information Commission. The ICO says some of its guidance is under review because of the Act.
Training
Lift College GDPR Training is 2 hours in 5 modules, from what counts as personal data to spotting and reporting a breach and the recent changes, with a CPD Standards Office accredited certificate the same day you pass. Staff who handle requests and breaches can take Data Protection Training.
Frequently asked questions
What does GDPR stand for?
What is GDPR in simple terms?
When did GDPR come into force?
Does GDPR still apply in the UK?
Who enforces GDPR in the UK?
What is the maximum GDPR fine in the UK?
Sources checked
- legislation.gov.uk: UK GDPR (checked 13 November 2026)
- legislation.gov.uk: GDPR as adopted, article 99 (checked 13 November 2026)
- legislation.gov.uk: Data Protection Act 2018, section 1 (checked 13 November 2026)
- legislation.gov.uk: UK GDPR, article 2 (checked 13 November 2026)
- ICO: A guide to the data protection principles (checked 13 November 2026)
- ICO: A guide to lawful basis (checked 13 November 2026)
- ICO: What is personal information (checked 13 November 2026)
- ICO: The Information Commission (Data (Use and Access) Act 2025) (checked 13 November 2026)
- GOV.UK: Data (Use and Access) Act factsheet, UK GDPR and DPA (checked 13 November 2026)
- Lift College: GDPR Training (checked 13 November 2026)