Who must comply with the UK GDPR, and what does it require by law?

Who the UK GDPR applies to

Article 3 says the UK GDPR applies to processing in the context of the activities of a controller or processor established in the UK, whether or not the processing happens in the UK. It also applies to organisations outside the UK that process the data of people in the UK when they offer them goods or services, paid or free, or monitor their behaviour in the UK.

Article 2 says it does not apply to an individual processing personal data for a purely personal or household activity, and it does not cover law enforcement or intelligence services processing, which other parts of the Data Protection Act 2018 deal with.

What it requires

• follow the seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability
• have a lawful basis for each use of personal data, decided before you start and documented
• give people clear privacy information, including your lawful basis and purposes
• use special category data only with a lawful basis and an additional condition
• keep personal data secure
• be able to show you comply

The seven lawful bases

Since the Data (Use and Access) Act 2025, the ICO lists seven: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests. Recognised legitimate interest covers pre-approved purposes: safeguarding vulnerable people, responding to emergencies, preventing or investigating crime, national security, public security and defence, and sharing information with an organisation that needs it for its public task at its request.

How long can you keep data?

The UK GDPR sets no fixed periods. Under the storage limitation principle, the ICO says you must not keep personal data longer than you need it, must be able to justify how long you keep it, should set standard retention periods where you can, and should review and erase or anonymise data you no longer need.

Who enforces it

The UK regulator is the Information Commission, which replaced the Information Commissioner on 30 September 2026 under the Data (Use and Access) Act 2025. Its guidance is still at ico.org.uk. Infringing the basic principles can bring fines of up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher.

Training

Lift College GDPR Training is 2 hours in 5 modules, with a CPD Standards Office accredited certificate the same day you pass, refreshed every 12 months. Staff who handle subject access requests and breaches can take Data Protection Training.