GDPR stands for the General Data Protection Regulation. In the UK it now means the UK GDPR, the version of EU Regulation 2016/679 kept in UK law by the European Union (Withdrawal) Act 2018 (now classed as assimilated law). It is read alongside the Data Protection Act 2018 and has been amended by the Data (Use and Access) Act 2025. It governs how organisations handle personal data. The heaviest fines are £17.5 million or 4% of worldwide turnover, whichever is higher. Since 30 September 2026 the regulator has been the Information Commission, which replaced the office of the Information Commissioner.
Key terms
- Personal data. Any information relating to an identified or identifiable natural person. This includes names, identification numbers, location data and online identifiers;
- Processing. Almost anything done with personal data: collecting, recording, storing, using, disclosing, combining or erasing it;
- Controller. The person or organisation that, alone or jointly with others, determines the purposes and means of processing;
- Processor. A person or organisation that processes personal data on behalf of a controller;
- Data subject. The individual the data is about.
Data controller or processor?
The distinction matters because the controller carries primary responsibility. Ask who determines the purposes of the processing (why) and its means (how). That party is the controller.
Take a company that outsources its payroll to an accountancy firm. The company is the controller of its employees' data: it decides who is paid, how much, and what records to keep. When the accountancy firm runs the payroll on the company's instructions, it acts as a processor and needs a written processing contract. But the same firm is a controller of its own staff data, and of client data it processes for its own regulatory purposes, such as anti-money laundering checks, because there it decides the purposes itself. One organisation can therefore be controller and processor at the same time, for different processing.
The seven principles
Article 5 requires personal data to be processed in line with these principles:
- Lawfulness, fairness and transparency;
- Purpose limitation. Data is collected for specified, explicit and legitimate purposes;
- Data minimisation;
- Accuracy;
- Storage limitation;
- Integrity and confidentiality. This covers security;
- Accountability. The controller must be able to demonstrate compliance.
Every processing activity also needs a lawful basis under Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. The 2025 Act added a seventh, recognised legitimate interests. It covers purposes listed in Annex 1, such as preventing crime, responding to emergencies and safeguarding vulnerable individuals. Unlike ordinary legitimate interests, it carries no test of whether the individual's interests override the controller's.
What changed with the Data (Use and Access) Act 2025
- Main data protection changes. Most of Part 5 came into force on 5 February 2026, simplifying aspects of the UK GDPR and updating enforcement powers;
- Complaints to controllers. From 19 June 2026, controllers must make it easy for people to complain, for example with an electronic complaint form, and must acknowledge each complaint within 30 days;
- New regulator. The office of Information Commissioner was abolished on 30 September 2026, and the Information Commission, a body corporate with a board, took over.
Breaches, fees and fines
| Obligation | UK rule |
|---|---|
| Reporting a personal data breach | Without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to result in a risk to individuals |
| Annual data protection fee | Tier 1 (micro) £52; tier 2 (small and medium) £78; tier 3 (large) £3,763; £5 less by direct debit |
| Higher maximum fine | £17.5 million or 4% of worldwide annual turnover, whichever is higher |
| Standard maximum fine | £8.7 million or 2% of worldwide annual turnover, whichever is higher |
Tier 1 covers controllers with turnover up to £632,000 or no more than 10 staff, as well as charities and small occupational pension schemes. Tier 2 covers turnover up to £36 million or no more than 250 staff.
UK GDPR and EU GDPR
The two texts started out identical and are drifting apart. A UK business that offers goods or services to people in the EU, or monitors their behaviour, can fall under the EU GDPR as well as the UK GDPR. It then has to follow both, together with any EU-specific requirements such as appointing a representative in the EU in writing.
The legal texts are on legislation.gov.uk: the UK GDPR definitions, Article 5 principles, Article 83 fines, section 118 of the Data (Use and Access) Act 2025 and the data protection fee regulations. The government's commencement page tracks the 2025 Act. See also our guide to an outsourced data protection officer.
Acumon's GDPR audit service reviews your controller and processor roles, lawful bases, breach procedures and the new complaints process against the amended UK GDPR.