Data protection & privacy laws in United Kingdom (2026)

The ICO imposed a £14 million penalty on Capita plc and Capita Pension Solutions for UK GDPR failures arising from a March 2023 cyber-attack that exposed personal data of over 6.6 million individuals. The fine was reduced from a proposed £45 million after Capita settled early and did not appeal.

The DUA Act 2025 — the UK's first major data legislation since Brexit — received Royal Assent, amending the UK GDPR, Data Protection Act 2018, and PECR to streamline compliance, establish a Digital Verification Services framework, introduce Smart Data schemes (extending Open Banking), and extend ICO powers. Commencement is phased over 12 months.

The Data Protection and Digital Information Bill — which aimed to replace UK GDPR with a lighter-touch domestic regime — was lost when Parliament was prorogued for the snap general election called on 22 May 2024. The incoming Labour government subsequently restarted the reform agenda, leading to the DUA Act 2025.

After a one-year transition period from its July 2020 publication, the ICO's statutory Children's Code required all online services likely accessed by under-18s to apply high-privacy defaults, minimise data collection, and give primacy to children's best interests. The code became a global template for children's privacy regulation.

Just two days before expiry of the post-Brexit data-bridge arrangement, the European Commission adopted two adequacy decisions — under the GDPR and the Law Enforcement Directive — confirming UK standards were 'essentially equivalent' to EU standards, enabling continued free EU-to-UK data flows. The decisions included an unprecedented four-year sunset clause expiring June 2025.

With the end of the Brexit transition period, the EU GDPR was retained into UK domestic law as the 'UK GDPR' under the European Union (Withdrawal) Act 2018, operating alongside the Data Protection Act 2018. The UK became a fully autonomous data-protection jurisdiction with the ICO as its sole lead supervisory authority.

The Data Protection Act 2018 (Royal Assent 23 May 2018) came into force alongside the EU GDPR, repealing the DPA 1998. It granted the ICO power to fine up to £17.5 million or 4% of global annual turnover, created UK-specific exemptions for national security, law enforcement, and immigration, and established individuals' enhanced rights including erasure and data portability.

PECR transposed the EU ePrivacy Directive 2002/58/EC into UK law, governing cookies, unsolicited electronic marketing, and telecommunications traffic and location data. It introduced the foundational 'cookie consent' requirement and remains in force today alongside the UK GDPR, enforced by the ICO.

The DPA 1998 (Royal Assent 16 July 1998) came into full force, implementing EU Directive 95/46/EC. It extended data-protection obligations beyond computerised records to structured manual filing systems, established the Information Commissioner's Office (replacing the Data Protection Registrar), and gave individuals the right to access personal data held about them.

The DPA 1984 received Royal Assent as the UK's inaugural data-protection statute, shaped by the OECD Privacy Guidelines (1980) and the Council of Europe Convention 108 (1981). It applied exclusively to computerised personal data, established eight core data-protection principles, and created the Data Protection Registrar — the forerunner of the ICO.