The UK's data privacy regulations are the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), all as amended by the Data (Use and Access) Act 2025. Every provision of that Act affecting data protection and PECR is now in force. The regulator is the Information Commission, which replaced the Information Commissioner on 30 September 2026. The most serious breaches carry fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, and that ceiling now applies to cookie and marketing breaches under PECR too.
Which laws apply
- UK GDPR. The core rules on handling personal data: the principles, the lawful bases, individuals' rights and the duties of controllers and processors;
- Data Protection Act 2018. Supplements the UK GDPR with exemptions, the regulator's powers and the penalty limits, and covers law enforcement and intelligence processing;
- PECR. Governs electronic marketing by email, text and phone, and cookies and similar technologies. It applies even where no personal data is processed;
- Data (Use and Access) Act 2025. Not a separate code but an amending Act. It changed the three laws above, added a complaints duty and replaced the Information Commissioner with a corporate body, the Information Commission.
What the UK GDPR requires
Article 5 sets the principles. Personal data must be processed lawfully, fairly and transparently, collected for specified purposes, limited to what is necessary, kept accurate, kept no longer than needed and kept secure. The controller must also be able to demonstrate compliance, which is the accountability principle.
Every use of personal data needs a lawful basis under Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. The 2025 Act added a seventh, recognised legitimate interests, for listed purposes where no balancing test is needed.
Two documentation duties catch many small firms out:
- Records of processing. Organisations with fewer than 250 staff are exempt from Article 30 records unless the processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. Running payroll is not occasional, so most employers need records;
- Data protection impact assessments. Required before processing that is likely to result in a high risk, particularly with new technologies.
Individuals' rights and the deadlines
People can ask for access to their data, correction, erasure, restriction and portability, and can object to some processing. A controller must respond within one month of receiving the request, or of receiving any identity information or fee it reasonably needs. That can be extended by two further months for complex or numerous requests, provided the person is told why within the first month. Since the 2025 Act, a subject access request only entitles the person to what the controller can find through a reasonable and proportionate search.
A new complaints duty has applied in full since 19 June 2026. Controllers must make it easy to complain, for example with a form that can be completed electronically, acknowledge each complaint within 30 days, and respond without undue delay.
Personal data breaches
A breach that risks people's rights and freedoms must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. If it is likely to result in a high risk, the people affected must also be told without undue delay. Our guide to incident response plans sets out how to be ready for this.
Marketing and cookies under PECR
Marketing emails and texts to individuals normally need consent. The exception is the soft opt-in: you can email existing customers about your own similar products and services if you collected their details during a sale or negotiation and gave them a simple way to refuse at that point and in every message.
Cookies need consent unless an exemption applies. Cookies that are strictly necessary to provide the service a user has asked for are exempt. The 2025 Act added exemptions, including analytics cookies used only to collect statistics to improve your own website or service, provided the data is not shared except with those helping you make improvements, users get clear information and users are given a simple way to object.
Breaches of the main PECR rules, including those on cookies and electronic marketing, now carry the same higher maximum penalty as the UK GDPR: £17.5 million or 4% of worldwide turnover.
The data protection fee
Most organisations that process personal data must pay an annual fee unless all their processing is exempt. The tiers are:
| Tier | Who | Fee |
|---|---|---|
| Tier 1: micro | Turnover up to £632,000, no more than 10 staff, or a charity | £52 |
| Tier 2: small and medium | Turnover up to £36 million or no more than 250 staff | £78 |
| Tier 3: large | Everyone else | £3,763 |
Worked example. A 14-person accountancy practice with £1.1 million turnover is outside tier 1 on both tests, so it pays £78. It runs payroll and holds client records, so it needs Article 30 records despite having fewer than 250 staff. It sends a monthly newsletter to existing clients about its own services, which can rely on the soft opt-in, and an email to bought-in prospects, which cannot.
A practical compliance checklist
- Map your data. Record what you hold, why, the lawful basis and how long you keep it;
- Update privacy notices. Reflect any reliance on recognised legitimate interests and the new complaints route;
- Set up a complaints process. Include an electronic form and a 30-day acknowledgement step;
- Review cookies and marketing lists. Check which cookies still need consent and which contacts were collected under the soft opt-in;
- Test breach response. Make sure someone can decide within 72 hours whether a breach must be reported;
- Pay the fee. Confirm your tier each year.
Sources: the UK GDPR, the Data Protection Act 2018 (including section 157 and section 164A), PECR, the Data Protection (Charges and Information) Regulations 2018 and the regulator's page on the Data (Use and Access) Act 2025. See also our guide to an outsourced data protection officer.
If you want an independent view of where your organisation stands, our GDPR audit reviews your records, notices and controls against the amended rules.