UK GDPR is an important part of the data protection framework that governs how organisations collect, use, store and protect personal information. Whether you run a business, work in an office, manage customer records or handle employee information, understanding UK GDPR can help you protect people’s privacy and meet your legal responsibilities.
From customer names and email addresses to employee records and financial details, organisations handle personal data every day. The law sets rules for using this information fairly, securely and transparently, while giving individuals rights over how their data is processed.
In this guide, we explain what UK GDPR means, who must follow the rules, the seven data protection principles, individual rights, business responsibilities and practical steps organisations can take to improve compliance.
What Is UK GDPR?
UK GDPR stands for the United Kingdom General Data Protection Regulation. It establishes rules for processing personal data and protecting individuals’ information.
It forms part of the UK’s data protection framework alongside the Data Protection Act 2018 and other relevant privacy legislation.
The UK GDPR applies to many organisations that process personal data, including businesses, charities, public authorities and other organisations. The specific requirements depend on the type of processing, the organisation’s activities and any applicable exemptions.
The Information Commissioner’s Office (ICO) is the UK’s independent data protection regulator. It provides guidance, investigates concerns and enforces data protection law.
You can find official information in the GOV.UK guide to data protection and the ICO’s UK GDPR guidance and resources.
Why Is UK GDPR Important?
Personal information can be misused, lost, disclosed without permission or accessed by people who have no legitimate reason to see it.
UK GDPR helps establish safeguards for handling personal data and encourages organisations to take responsibility for their information practices.
Protecting People’s Privacy
Individuals should understand how their information is collected and used. Data protection rules help prevent unnecessary or unfair processing and support people’s rights over their personal information.
Building Customer Trust
Customers are more likely to trust organisations that explain how information is used and take appropriate steps to protect it.
Clear privacy information, secure systems and responsible data handling can strengthen an organisation’s reputation.
Reducing Data Protection Risks
Poor data handling can expose organisations to complaints, security incidents, regulatory action and reputational damage.
Following appropriate procedures helps organisations identify risks and reduce the likelihood of avoidable problems.
Supporting Legal Compliance
Organisations that process personal data must understand which legal requirements apply to their activities. UK GDPR provides a framework for making decisions about data collection, access, storage, sharing and deletion.
What Counts as Personal Data Under UK GDPR?
Personal data is information relating to an identified or identifiable living individual.
It can identify someone directly or indirectly, depending on the information available and how it can be combined with other details.
Examples include:
Information does not always need to include someone’s full name to qualify as personal data.
For example, an employee number or customer reference may count as personal data if it can be linked to an identifiable individual.
What Is Special Category Data?
Some personal information receives additional protection because of its sensitive nature.
Special category data includes information about a person’s:
Organisations generally need both a lawful basis for processing and an applicable special category condition when handling this information.
Criminal offence data is subject to separate requirements and safeguards.
Who Needs to Follow UK GDPR?
UK GDPR can apply to organisations across many sectors, including:
Businesses
Companies that collect customer details, process orders, manage staff records or run marketing campaigns may need to comply.
Small Businesses and Sole Traders
Small businesses are not automatically exempt simply because they have few employees. If they process personal data, they need to understand the requirements that apply to their activities.
Employers
Employers commonly process information about employees, job applicants, payroll, attendance, performance and workplace matters.
They must handle these records appropriately and explain how personal data is used.
Healthcare and Social Care Providers
Healthcare and social care organisations may process sensitive information about patients, service users and employees. Appropriate safeguards are particularly important when handling health records.
Charities and Non-Profit Organisations
Charities may collect information about donors, volunteers, beneficiaries, employees and supporters. Their data protection responsibilities depend on the information they process and how they use it.
Public Authorities
Public bodies also need to follow applicable data protection requirements when handling personal information as part of their services.
The Seven UK GDPR Data Protection Principles
The seven data protection principles form the foundation of UK GDPR. Organisations should consider them whenever they collect, use, share or store personal information.
The ICO’s guide to the data protection principles explains these requirements in more detail.
Lawfulness, Fairness and Transparency
Personal data must be processed lawfully, fairly and transparently.
Organisations need an appropriate lawful basis for processing and should explain their practices clearly.
For example, a business should provide suitable privacy information explaining what customer data it collects and why it uses that information.
Purpose Limitation
Personal data should be collected for specified, explicit and legitimate purposes.
Organisations should not use information for incompatible purposes without a valid legal justification.
For example, information collected to deliver an order should not automatically be treated as permission to use the same details for unrelated marketing.
Whether further use is permitted depends on the circumstances and applicable legal requirements.
Data Minimisation
Organisations should collect only the personal data that is adequate, relevant and necessary for their stated purposes.
A business collecting information for a newsletter, for example, should consider whether it genuinely needs each requested detail.
Collecting unnecessary information increases the amount of data that must be protected and managed.
Accuracy
Personal data should be accurate and kept up to date where necessary.
Organisations should take reasonable steps to correct inaccurate information, particularly when errors could affect decisions or services.
For example, an employer should have suitable procedures for correcting inaccurate employee records.
Storage Limitation
Personal data should not be kept in identifiable form for longer than necessary for the purpose for which it is processed, subject to applicable exceptions.
Organisations should establish appropriate retention periods and review whether information still needs to be held.
Keeping information indefinitely without a valid reason can increase privacy and security risks.
Integrity and Confidentiality
Organisations must use appropriate technical and organisational measures to protect personal data.
Depending on the risks, these measures may include access controls, encryption, staff training, secure backups, strong authentication and procedures for handling sensitive records.
The appropriate safeguards depend on the nature of the information and the risks associated with processing it.
Accountability
Organisations must take responsibility for complying with data protection principles and be able to demonstrate their compliance.
This may involve maintaining records, documenting decisions, training staff, reviewing procedures and carrying out appropriate assessments.
Accountability means that organisations should be able to explain how their data protection arrangements work rather than relying on informal assurances.
What Are the Lawful Bases for Processing Personal Data?
UK GDPR requires organisations to identify an appropriate lawful basis for processing personal data.
There are six main lawful bases.
Consent
Consent means an individual has agreed to the processing for a specific purpose. Where consent is relied upon, it must meet the legal requirements, including being freely given, specific, informed and unambiguous.
Organisations must also understand how consent can be withdrawn.
Contract
Processing may be lawful when it is necessary to enter into or perform a contract with the individual, or to take certain steps requested by them before entering into a contract.
For example, a business may need a customer’s delivery address to fulfil an order.
Legal Obligation
An organisation may need to process personal data to comply with a legal obligation.
The obligation must apply to the organisation, and the processing must be necessary for compliance.
Vital Interests
This basis may apply when processing is necessary to protect someone’s life or another person’s vital interests in the circumstances permitted by law.
Public Task
Public task may apply when processing is necessary to perform a task in the public interest or exercise official authority, where the relevant legal requirements are met.
Legitimate Interests
An organisation may be able to rely on legitimate interests where the processing is necessary for a legitimate interest and the individual’s interests, rights and freedoms do not override it.
This requires careful consideration and, where appropriate, a documented assessment.
Legitimate interests is not a universal permission to use personal data. Organisations must determine whether it is suitable for the particular purpose.
You can explore the requirements in the ICO’s guidance on lawful bases.
What Rights Do Individuals Have Under UK GDPR?
UK GDPR gives individuals rights relating to their personal data, although these rights are subject to specific conditions and exemptions.
Organisations should understand how to recognise and respond to requests.
Right to Be Informed
Individuals have the right to receive information about how their personal data is collected and used.
Organisations generally provide this information through privacy notices.
Right of Access
Individuals can request access to their personal data. These requests are commonly called subject access requests.
An organisation must recognise valid requests and respond within the applicable legal timeframe, taking account of relevant rules and circumstances.
Right to Rectification
Individuals can ask for inaccurate personal data to be corrected. They may also request that incomplete information be completed where appropriate.
Right to Erasure
In certain circumstances, individuals can request that their personal data be erased.
This is sometimes called the right to be forgotten, but it is not absolute. An organisation may be permitted or required to retain information in some circumstances.
Right to Restrict Processing
Individuals may have the right to restrict how their personal data is processed in specific circumstances.
Where a valid restriction applies, the organisation must follow the relevant requirements.
Right to Data Portability
In certain circumstances, individuals can obtain personal data they have provided in a structured, commonly used and machine-readable format and transmit it to another organisation.
This right applies under particular conditions rather than to every type of processing.
Right to Object
Individuals can object to certain types of processing, including processing based on legitimate interests or public task in applicable circumstances.
The right to object to direct marketing is particularly important: individuals can object to their personal data being processed for direct marketing, including related profiling, and the organisation must stop that processing.
Rights Relating to Automated Decision-Making
UK GDPR also provides protections concerning certain automated decisions and profiling.
The Data (Use and Access) Act 2025 amended the framework for automated decision-making, with safeguards applying to relevant processing. Organisations should check current requirements rather than relying solely on older summaries of the rules.
The GOV.UK data protection guide provides an overview of individual rights.
Strengthen Your Data Protection Knowledge
Develop your understanding of privacy and compliance with UK General Data Protection Regulation (GDPR), exploring personal data, individual rights, lawful processing, security responsibilities and the principles that support responsible data protection practices.
What Is a Data Controller and Data Processor?
Understanding the difference between a data controller and a data processor helps organisations identify their responsibilities.
Data Controller
A data controller determines the purposes and means of processing personal data.
For example, a business that decides why it collects customer details and how those details will be used will generally act as a controller for that processing.
Data Processor
A data processor processes personal data on behalf of a controller and according to the relevant instructions and arrangements.
For example, a business might use an external provider to host a customer database or manage payroll.
A processor has its own legal responsibilities, while the controller remains responsible for meeting applicable controller obligations.
Organisations should establish appropriate contracts and procedures when using processors.
How Can Businesses Comply With UK GDPR?
Compliance involves more than adding a privacy policy to a website. Organisations need practical procedures for managing personal information throughout its lifecycle.
Identify the Personal Data You Collect
Start by identifying the personal information your organisation holds, where it comes from, why it is collected and who can access it.
This may include customer records, employee information, website enquiries, marketing databases and supplier contacts.
Establish a Lawful Basis
Identify the lawful basis for each processing purpose.
Avoid assuming that consent is always required or that legitimate interests is always sufficient. The correct basis depends on the activity and circumstances.
Create Clear Privacy Notices
Explain what information you collect, why you collect it, how you use it, how long you retain it and what rights individuals have.
Privacy information should be accessible, accurate and appropriate for the audience.
Limit Access to Personal Information
Only authorised people should have access to the information they need to perform their responsibilities.
Use appropriate permissions, account controls and procedures for granting and removing access.
Train Employees
Employees should understand how to handle personal information, recognise potential data breaches and report concerns.
Training should reflect their responsibilities and the types of information they handle.
Establish Retention and Deletion Procedures
Determine how long different categories of personal data need to be retained.
Delete or securely dispose of information when it is no longer necessary, unless a legal requirement or valid exception justifies continued retention.
Prepare for Data Breaches
Create a procedure for identifying, containing, investigating and documenting personal data breaches.
Some breaches must be reported to the ICO within 72 hours of becoming aware of them, where the legal reporting threshold is met. Affected individuals may also need to be informed where the breach is likely to result in a high risk to their rights and freedoms.
Organisations should assess each incident promptly and follow the applicable reporting requirements.
Review Suppliers and Third Parties
If external providers process personal data on your behalf, check their suitability and establish appropriate contractual arrangements.
Review who can access the data, where it is processed and what security measures are in place.
What Happens If an Organisation Breaches UK GDPR?
A data protection breach can have consequences for both individuals and organisations.
Potential consequences include:
The maximum administrative fine for certain serious infringements can reach £17.5 million or 4% of an organisation’s total worldwide annual turnover, whichever is higher, subject to the applicable legal provisions.
Not every breach results in a fine. The ICO considers the circumstances and relevant legal factors when deciding what regulatory action is appropriate.
The best approach is to establish suitable safeguards, respond promptly to incidents and demonstrate accountability.
UK GDPR and the Data (Use and Access) Act 2025
UK data protection law has evolved since the original UK GDPR framework was established.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amended parts of the UK’s data protection and privacy legislation. It did not replace UK GDPR or the Data Protection Act 2018.
As of October 2026, the ICO states that all provisions affecting data protection law under the Act are in force. The changes include provisions concerning automated decision-making, complaints procedures, research and other aspects of data protection.
Organisations should therefore use current guidance when reviewing their compliance arrangements.
For more information, read the government’s overview of Data (Use and Access) Act 2025 data protection changes and the ICO’s explanation for organisations.
UK GDPR Checklist for Businesses
Use this checklist as a starting point for reviewing your organisation’s data protection practices.
This checklist is a practical starting point, not a complete legal compliance assessment. Requirements depend on the organisation’s activities and the circumstances of the processing.
Frequently Asked Questions
What does UK GDPR stand for?
UK GDPR stands for the United Kingdom General Data Protection Regulation. It establishes rules for processing personal data and protecting individuals’ privacy, alongside the Data Protection Act 2018 and other applicable legislation.
Does UK GDPR apply to small businesses?
Yes, UK GDPR can apply to small businesses and sole traders that process personal data. The precise obligations depend on the nature of their activities, the information they handle and any applicable exemptions.
What are the seven UK GDPR principles?
The seven principles are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. They form the foundation of responsible personal data processing.
What is the difference between UK GDPR and the Data Protection Act 2018?
UK GDPR and the Data Protection Act 2018 work together within the UK’s data protection framework. The Act supplements the UK GDPR and contains additional provisions, including rules for certain types of processing and exemptions.
Has UK GDPR changed under the Data (Use and Access) Act 2025?
Yes. The Data (Use and Access) Act 2025 amended parts of UK data protection and privacy law without replacing UK GDPR. The ICO states that all provisions affecting data protection law under the Act are now in force, so organisations should consult current guidance when reviewing their responsibilities.
Strengthen Your Data Protection Knowledge
Develop your understanding of privacy and compliance with UK General Data Protection Regulation (GDPR), exploring personal data, individual rights, lawful processing, security responsibilities and the principles that support responsible data protection practices.
Final Thoughts
UK GDPR is central to how organisations protect personal information and respect individual privacy. Understanding the seven data protection principles, lawful bases, individual rights and security responsibilities can help businesses develop more responsible data handling practices.
Compliance should be part of everyday operations rather than a one-off exercise. Clear privacy notices, appropriate access controls, staff training, retention procedures and a well-defined breach response process all contribute to stronger data protection.
Because UK data protection law continues to evolve, organisations should review their practices regularly and refer to the latest ICO guidance when making decisions.
