Is there a difference between UK and EU GDPR?

Territorial scope and dates

Applies across the EU/EEA. Became applicable in the EU on 25 May 2018.

Applies in the UK as a separate domestic regime from 1 January 2021, alongside the Data Protection Act 2018.

Enforcement

Enforced by national supervisory authorities, coordinating through the European Data Protection Board.

Enforced by the Information Commissioner’s Office (ICO).

International transfers

Uses EU adequacy decisions and safeguards such as the European Commission’s standard contractual clauses (SCCs).

Uses UK adequacy regulations and safeguards such as the UK IDTA or EU SCCs with the UK Addendum. EU SCCs alone are insufficient for UK restricted transfers.

Lawful bases

Six lawful bases. Ordinary legitimate interests requires balancing those interests against individuals’ rights.

Seven lawful bases, including recognised legitimate interests for specified purposes. This additional basis removes the balancing test, but necessity and other requirements still apply.

Significant automated decisions

Solely automated decisions with legal or similarly significant effects generally require contractual necessity, explicit consent or authorisation by law, with applicable safeguards.

Allows broader use of lawful bases, including legitimate interests, for these decisions involving non-special-category data. Safeguards remain mandatory, with stricter conditions for special-category data.

Highest-tier administrative fines

Up to €20 million or 4% of a business’s total worldwide annual turnover, whichever is higher.

Up to £17.5 million or 4% of a business’s total worldwide annual turnover, whichever is higher.