UK GDPR and the Data (Use and Access) Act
Also known as: UK GDPR, Data (Use and Access) Act 2025, DUAA, UK data protection law, Data Protection Act 2018
UK GDPR is the version of the EU's General Data Protection Regulation that the United Kingdom kept in domestic law after Brexit, alongside the Data Protection Act 2018.
The Data (Use and Access) Act 2025 then reformed it, easing rules on legitimate interests, automated decisions, and cookies. While the reforms gave the UK more flexibility, they were carefully limited, because straying too far from EU rules could cost the UK its EU adequacy status.
UK GDPR and the Data (Use and Access) Act, explained at three levels
At home
Think of UK GDPR as a photocopy of the EU's privacy rulebook that the UK kept after Brexit, then started editing in the margins. Your rights are almost the same as in the EU: you can see, correct, and delete your personal data and object to some uses. The 2025 Data (Use and Access) Act made targeted edits, mostly easing rules for businesses rather than removing your rights.
At work
UK GDPR is the UK's domestic version of the EU GDPR, read alongside the Data Protection Act 2018. The Data (Use and Access) Act 2025 amended both, changing rules on legitimate interests, automated decisions, research, cookies, and complaints handling. Businesses care because UK and EU rules are now similar but not identical, so a company serving both markets must track the differences and may need representatives in each.
At home
The 2025 Act changed a few mechanisms you'll notice. Some low-risk cookies, such as those for basic analytics or remembering site preferences, no longer need consent, as long as you're told and can object. Automated decisions became broadly permitted with safeguards: you must be told, can ask a human to review, and can contest the outcome. Organizations must also run a proper complaints process before you take a complaint to the regulator.
At work
The Act adds 'recognised legitimate interests,' a fixed list including crime prevention, safeguarding, emergencies, and national security, that organizations can rely on without a balancing test. It eases rules for scientific research and further processing, limits access-request searches to what is 'reasonable and proportionate,' and raises fines under the electronic marketing rules, PECR, to UK GDPR levels. It also sets up 'smart data' schemes, extending the open banking idea to other sectors, and replaces the ICO with an Information Commission.
At home
The biggest conceptual shift concerns automated decisions. The old Article 22 broadly banned solely automated decisions with legal or similarly significant effects unless an exception applied. The new rules flip that default: such decisions are allowed if safeguards are in place, except when they rely on special category data such as health or ethnicity. While that makes room for useful automation, in my view the safeguards (information, human review, the right to contest) will only be as strong as their enforcement.
At work
For international businesses, the issue is divergence management. The UK runs its own transfer tools, the International Data Transfer Agreement and the UK addendum to EU SCCs, and its own adequacy regulations, including a data bridge to the US. The European Commission reviewed the reforms and renewed the UK's adequacy decisions in December 2025, running to December 2031. Firms usually keep one core program built to EU GDPR and maintain a short register of UK-specific differences.
Real-world examples
At home
Thomas, a Londoner, noticed that some websites stopped asking for consent to basic analytics cookies after the UK reforms. He could still opt out in their settings, but the banners became less frequent for low-risk tracking.
At work
Fatima runs privacy at a Canadian software company with clients in London and Paris. After the Data (Use and Access) Act passed, she updated the UK section of the company's privacy notice and cookie settings, but kept the core program aligned with EU GDPR, since the EU remained the stricter regime.
How it compares
| feature | UK GDPR (as reformed) | EU GDPR |
|---|---|---|
| Legal basis | Includes recognised legitimate interests without balancing test | Legitimate interests always require balancing |
| Automated decisions | Broadly permitted with safeguards | Restricted, with limited exceptions |
| Low-risk cookies | Some exempt from consent | Consent generally required under ePrivacy rules |
| Regulator | Information Commission (formerly ICO) | National authorities plus the EDPB |
| Transfers out | UK adequacy regulations, IDTA, addendum | Adequacy decisions, SCCs, BCRs |
UK GDPR remains close to EU GDPR, with targeted relaxations that the EU has so far accepted.
For analysts
If you operate in both the UK and the EU, I'd resist the temptation to run separate programs. Build to EU GDPR and document UK exceptions. The differences are real but small, and two programs double the maintenance.
History & origin
When the Brexit transition period ended on December 31, 2020, GDPR was copied into UK law as 'UK GDPR,' effective January 1, 2021. The European Commission granted the UK an adequacy decision in June 2021, allowing EU data to keep flowing freely, with a sunset clause requiring review. After assessing the 2025 reforms, the Commission renewed the UK's adequacy in December 2025, until December 2031. The UK government tried several reform bills, including the Data Protection and Digital Information Bill, which died when the 2024 general election was called. The Data (Use and Access) Act received Royal Assent on June 19, 2025, with provisions commenced in stages. It also restructures the Information Commissioner's Office into an Information Commission. In my opinion, the UK's reforms show the gravitational pull of EU rules. Even after leaving, the UK couldn't move far without risking a major trade cost.