The UK’s data protection regime consists of the UK General Data Regulation (UK GDPR), the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
The UK GDPR is the retained EU law version of the General Data Protection Regulation (GDPR) which became directly applicable to all EU member states from the 25 May 2018. Following Brexit, it was amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419) (DP Brexit Regulations) to integrate the EU GDPR into UK law.
The DPA, enacted alongside the GDPR, aimed to ensure the UK’s data protection regime remained aligned with the EU's post-Brexit. It too was amended by the DP Brexit Regulations. Together, the UK GDPR and DPA 2018 form the core of the UK’s data protection framework.
PECR is domestic law which continues to apply post-brexit. It sits alongside the UK GDPR and DPA, providing individuals with specific privacy rights in relation to electronic communication and includes specific rules on:
Importantly, the PECR apply even if a business is not processing personal data.
The Data (Use and Access) Act 2025 (DUUA), which received Royal Assent in June 2025, introduces substantial amendments to the UK data protection regime. Its amendments are intended to promote innovation and economic growth for businesses, whilst continuing to protect data subject rights. The majority of the provisions are not yet in effect and will require secondary legislation to bring them into effect. The Secretary of State will implement this secondary legislation by June 2026.
The regime applies to UK controllers and processors processing personal data in the UK. It also applies to controllers and processors in the EU if their processing activities involve offering goods or services to UK residents, or monitoring the behaviour of data subjects, to the extent that such behaviour takes place within the UK.
The EU GDPR will also apply to UK controllers or processors if they have an establishment in the European Economic Area (EEA), have customers in the EEA, or monitor the behaviour of data subjects, to the extent that such behaviour takes place within the EEA.
The regime defines processing as any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
‘personal data’ means any information relating to an identified or identifiable natural person (data subject).
A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Certain types of personal data are further categorised as special category data because it is considered more sensitive and therefore subject to stricter protections. This category includes information relating to an individual’s race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), health, sex life, or sexual orientation.
A business may be a controller, a processor, or both. It is important for businesses to understand the distinction as different legal obligations apply depending on the role.
A ‘controller’ is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For example, A retail company that collects and decides how to use customers’ personal data for marketing and sales purposes would fall under the definition of controller.
A ‘processor’ is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. For example, a cloud storage provider that stores personal data on behalf of the retail company would fall under the definition of processor.
A business can only process personal data if they have a legal basis for doing so under Article 6 of the UK GDPR. Article 6 sets out the following legal bases for processing:
The DUAA has also introduced a new lawful basis which allows processing that is necessary for reasons specified in an annex of “recognised legitimate interests”. This lawful basis differs to the standard legitimate interest basis by removing the requirement for a business to carry out an additional balancing test which assesses the benefits of processing against the impacts on the rights and freedoms of a data subject. However, a necessity test still applies - i.e. is the processing necessary to fulfil one of the recognised legitimate interests.
For any special category data, a business must also be able to demonstrate that one of the conditions in Article 9 of the UK GDPR apply. For example, processing special category data is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
Article 5 of the UK GDPR sets out seven key principles that should lie at the heart of a business’s approach to processing personal data. These include:
Data subjects have a number of rights under the UK GDPR including the:
If you require assistance with any aspect of data protection and privacy law, or have questions about your legal obligations, please contact our Data Protection and Privacy team on +44 204 600 9907 or email info@culbertellis.com.
