UK GDPR and the post-Brexit rules your website must follow

UK GDPR is the United Kingdom's version of the EU General Data Protection Regulation, kept in UK law when the Brexit transition period ended on 1 January 2021 and enforced by the Information Commissioner's Office (ICO). It works alongside the Data Protection Act 2018 and, for cookies, the Privacy and Electronic Communications Regulations 2003 (PECR). The Data (Use and Access) Act 2025 (DUAA) has since amended all three, with most changes in force from 5 February 2026.

For a website, three things matter most in 2026: the principles and rights are still close to the EU's, some low-risk cookies no longer need opt-in consent, and cookie breaches can now be fined on the same scale as UK GDPR breaches.

UK GDPR in three laws

When the transition period ended, the UK kept the text of the EU GDPR and adapted it to work in the British legal system. The result mirrors the EU original in structure, but the ICO enforces it rather than the EU's national authorities and the European Data Protection Board.

• UK GDPR sets the core principles, data subject rights and obligations for controllers and processors.
• The Data Protection Act 2018 (DPA 2018) supplements it, covering law enforcement processing, national security exemptions and the age at which a child can consent to an online service (13 in the UK).
• PECR governs cookies and similar technologies, direct marketing and electronic communications. If your website stores or reads information on a visitor's device, PECR decides when you need consent.

UK GDPR applies to any organisation that offers goods or services to people in the UK or monitors their behaviour, wherever the organisation is based. A software company in Sydney selling subscriptions to UK customers is covered just as much as a retailer in London.

The seven principles of UK GDPR

UK GDPR rests on seven data protection principles in Article 5. They are legally binding, and every decision about collecting, storing or using personal data should trace back to them.

Accountability puts the burden of proof on you. If the ICO investigates, you need records of processing, data protection impact assessments where required, and documented lawful bases.

Lawful bases now include recognised legitimate interests

Article 6 sets out six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. For most websites, consent (marketing cookies and email lists), contract (processing an order) and legitimate interests are the ones that matter.

Since 5 February 2026, the DUAA adds "recognised legitimate interests" (Article 6(1)(ea) and Annex 1), a closed list of purposes such as responding to emergencies, safeguarding vulnerable people and detecting or preventing crime. For those purposes you do not need the balancing test of a legitimate interests assessment. The list is narrow, and most routine website processing still relies on one of the original bases.

Data subject rights and the new complaints duty

Individuals can ask for access to their data, correction, erasure, restriction, portability and an objection to processing, and you generally have one month to respond. The right of access, through a subject access request, is the one used most.

The DUAA changed how these requests work. Section 78 limits an access request to what a "reasonable and proportionate search" can find, and it is treated as in force from 1 January 2024. Section 76, in force since 5 February 2026, adds rules on when the clock stops while you wait for information you need from the requester.

Two other changes are in force. New Articles 22A to 22D replaced Article 22 on automated decisions on 5 February 2026: decisions based solely on automated processing are allowed with safeguards, while the stricter rule now applies to decisions using special category data. And since 19 June 2026, section 164A of the DPA 2018 requires controllers to make it easy to complain, for example with an electronic complaint form, to acknowledge a complaint within 30 days and to respond and report the outcome without undue delay.

Cookies and PECR in 2026

For websites, cookies are where UK data protection gets practical. The rule sits in regulation 6 of PECR. PECR decides when consent is needed, and UK GDPR defines what valid consent looks like: freely given, specific, informed and unambiguous, with refusing as easy as accepting.

Since 5 February 2026, Schedule A1 to PECR sets out when consent is not needed:

• Strictly necessary storage for a service the user asked for, now with examples in the law: security, fraud prevention, detecting technical faults, authentication and remembering what the user selected or entered.
• Statistics (paragraph 5): first-party analytics whose sole purpose is to improve the service or website, where the information is shared only with someone helping to make those improvements, and the user gets clear information and a free, simple way to object.
• Appearance and functionality (paragraph 6): storage that adapts how the website looks or works to the user's preferences, again with clear information and a free way to object.
• Emergency assistance (paragraph 7): locating a user who asks for emergency help.

Everything else still needs consent before it is set, including advertising cookies, cross-site tracking such as _fbp, and analytics that share data beyond service improvement. The ICO finalised its guidance on storage and access technologies on 29 April 2026, after consultations on the draft and on the DUAA changes. The UK cookie exemptions article walks through the conditions.

Higher PECR fines and no harm threshold

The same commencement regulations (SI 2026/82) brought in the DUAA's PECR enforcement changes on 5 February 2026. Cookie breaches can now be fined up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher, instead of the old cap of GBP 500,000, and the ICO no longer has to show that a breach was likely to cause substantial damage or distress before it can fine. The wider changes are covered in what the Data Use and Access Act means in practice.

How UK GDPR differs from EU GDPR

Is there a difference between UK and EU GDPR? Yes, but a limited one. The principles, rights and lawful bases are still the same, while the DUAA has created specific differences: recognised legitimate interests, wider room for automated decisions, a "not materially lower" test for transfers, a codified search standard for access requests and broader cookie exceptions.

Enforcement: what the ICO has done on cookies

The ICO can fine up to GBP 17.5 million or 4% of worldwide annual turnover for UK GDPR breaches, and now for PECR breaches too. On cookies, it has relied on reviews and warnings more than fines so far.

In January 2025 it extended its cookie review to the top 1,000 UK websites, after contacting 134 of the top 200 about their banners. By December 2025, according to the ICO's report on the review, 979 of the 1,000 sites met its checks: 415 without intervention and 564 after the ICO contacted them. It issued 17 preliminary enforcement notices and continued action against the 21 sites still failing. The checks were whether rejecting advertising cookies was as easy as accepting them and whether advertising cookies were set without consent.

European regulators have gone further. In September 2025, France's CNIL fined Shein EUR 150 million for setting cookies before any choice and continuing to set them after a refusal. The cookie fines roundup tracks recent decisions.

UK-EU adequacy is renewed until 2031

The European Commission's adequacy decisions let personal data flow from the EU to the UK without extra safeguards such as standard contractual clauses. The original decisions of June 2021 were extended while the Commission assessed the DUAA, and on 19 December 2025 it renewed them until 27 December 2031. The Commission keeps monitoring UK changes, and it can amend, suspend or revoke the decisions if UK law moves too far from EU standards.

Practical steps for website owners

Audit your cookies

Find every cookie and tracker on your site with a cookie scanner and sort each into strictly necessary, statistics, appearance or functionality, analytics shared with third parties, and marketing. Embedded videos, social buttons and chat widgets often set cookies you did not add yourself.

Decide which cookies the new exceptions cover

A first-party statistics cookie used only to improve your site can run with clear information and an easy opt-out. Analytics that shares data with an advertising platform, and every marketing cookie, still need consent first.

Fix your cookie banner

Rejecting must be as easy as accepting. A large "Accept all" button next to a small "Manage settings" link does not give a fair choice, and no consent-based cookie should run before the visitor decides.

Update your privacy notice

Cover what you collect, your lawful basis for each purpose, who you share data with, how long you keep it, how people exercise their rights and how they can complain to you.

Prepare for requests and complaints

Have a process for access requests within one month and a complaint route that acknowledges complaints within 30 days. The privacy laws by region overview shows how UK rules compare with other countries.

Questions about UK GDPR

Show UK visitors the banner the new rules call for

Kukie.io scans your site, sorts its cookies into categories, blocks the ones that need consent until visitors choose and keeps a record of each choice, with region rules for UK visitors.

Start free