Does GDPR apply to the UK?

The UK has its own GDPR regime, and EU GDPR can also apply to particular activities of UK organisations.

• UK GDPR applies to personal data processing in the context of a UK establishment’s activities, even if the processing takes place elsewhere. It can also cover organisations outside the UK when their processing relates to offering goods or services to people in the UK or monitoring their behaviour there.

• EU GDPR can apply to a UK organisation when processing is connected with an EU/EEA establishment, or relates to offering goods or services to people in the EU/EEA or monitoring their behaviour there.

For example, a UK online retailer that targets customers in France may need to comply with both regimes. The ICO’s guidance on operating across UK and EU data protection regimes explains this overlap.

UK and EU GDPR are separate laws. The relevant obligations depend on the organisation’s activities and connections to each territory, rather than simply where its website is hosted or the nationality of its customers.