UK GDPR and EU GDPR

The UK GDPR and the EU GDPR are the laws that govern how organisations collect, use, share and protect personal data about people in the UK and the EU. They apply to almost every organisation that handles personal data there, as a controller or a processor, whatever its size. They are enforced by regulators; nobody certifies you against them.

What it is and who it applies to

The EU GDPR is Regulation (EU) 2016/679, which has applied since 25 May 2018. The UK GDPR is the same text kept in UK law after Brexit, read with the Data Protection Act 2018 and amended several times since, most substantially by the Data (Use and Access) Act 2025. Because the UK kept the EU’s numbering, an article number usually means the same thing in both, and this section says where they now differ.

The test for whether either law applies has two parts. First, you process personal data: any information about an identifiable living person, from a name in a CRM to an IP address in a log. Second, you have a link to the territory: you are established there, or you offer goods or services to people there, or you monitor their behaviour there (UK GDPR Article 3, and the same article in EU GDPR). A UK company with EU customers usually sits under both.

Your duties depend on your role. A controller decides why and how data is processed; a processor acts on a controller’s instructions. Most organisations are both: controller of their own staff and customer data, processor of the data their customers put into their service.

Some data needs more care. Special category data, such as health, ethnic origin, religion, sexual orientation, trade union membership and biometrics used to identify someone, needs an extra condition on top of a lawful basis. Data about criminal convictions has its own rules. Children’s data is not a separate category, but it raises the bar on transparency, consent and design.

This is guidance to help you understand the requirement, not legal advice.

Structure

Both texts run in the same order: scope and definitions, principles, lawful basis, rights, duties of controllers and processors, transfers, then regulators and remedies. The table groups the articles you will work with, paraphrased; the numbers apply to both texts unless the row says otherwise.

Certification and enforcement

No general GDPR certification exists. Articles 42 and 43 allow regulators to approve certification schemes for particular kinds of processing, but none covers the regulation as a whole. Compliance is shown by your records, policies and decisions, and tested when a regulator, a customer or a court asks.

Individuals can also enforce the law themselves: they can complain to the regulator and claim compensation in the courts for damage caused by a breach of it.

Regulators usually hear about an organisation through a complaint from someone whose data it holds or through a breach it reported. How you handle requests and incidents therefore decides most first contacts, and the records you keep decide how the conversation goes.

How the pieces fit

The obligations form a chain. You need a lawful basis before you process anything. Transparency tells people which basis and purpose you rely on, and their rights hang off what you told them. Processing that is high risk needs an assessment first. Data you pass to processors or send abroad carries your duties with it. Security protects all of it (UK GDPR Article 32), and the breach rules apply when that fails. Accountability (UK GDPR Article 5(2)) ties the chain together: you must be able to show each link, and your record of processing (UK GDPR Article 30) is where that starts.

Regulators read the chain in reverse. Faced with a complaint, they ask for the record of processing, then the lawful basis it names, then the notice that told people about it. A gap early in the chain usually explains a failure later on.

In this section

• Lawful basis for processing: which of the six bases fits each use of data, and what extra condition sensitive data needs?
• Transparency and privacy notices: what must you tell people, and when?
• Individual rights and subject access requests: what can people ask for, and how fast must you answer?
• Data protection impact assessments: when must you assess processing before you start it?
• Processors and data processing agreements: what must a contract with a processor say?
• International data transfers: how do you send personal data abroad lawfully from the UK or the EU?
• Personal data breaches: when must you tell the regulator and the people affected?
• Records of processing activities: what must your record hold, and who is exempt?
• Data (Use and Access) Act 2025 changes to UK GDPR: what changed in the UK, and from when?

How Sted maps it

UK GDPR and EU GDPR are both in Sted’s catalogue, as separate entries. Sted treats each as applying when you process personal data and have a link to that territory, reads your controller and processor roles from the processing activities you describe, and notes when you need a representative. Each recommended standard shows its basis and Sted’s confidence, with the reasons it applies.

Onboarding asks about your processing activities and transfers abroad, and Summary lists them. The documents come from Sted’s knowledge base and are drafted for your organisation for you to review. For each law that means a set of policies, procedures, notices and record templates led by the Personal Data Protection Policy and the two privacy notices.

Sted has no template for a data protection impact assessment; you hold that assessment yourself. Sted does not decide your lawful basis, answer requests from individuals, or judge whether a breach must be reported. Those decisions stay with you and your advisers.

Frequently asked questions