🇬🇧 United Kingdom
After Brexit the UK retained the EU framework as the UK GDPR, read together with the Data Protection Act 2018. The Data (Use and Access) Act 2025 amended both, created a statutory trust framework for digital verification services, and replaced the Information Commissioner's Office with the Information Commission (still known as the ICO) from 30 September 2026.
The UK GDPR is the UK's post-Brexit version of the EU GDPR, applying since 1 January 2021 and read alongside the Data Protection Act 2018. It keeps the same core principles, individual rights, and accountability duties under UK supervision. The Data (Use and Access) Act 2025 amended it, with most data protection changes (recognised legitimate interests, wider automated decision-making with safeguards, a 'stop the clock' rule for subject access requests and new cookie exemptions) commencing on 5 February 2026.
Read the breakdown →The Data Protection Act 2018 is the UK's national data protection law that supplements the UK GDPR and implements rules for areas outside its scope, including law enforcement and intelligence services processing. Together with the UK GDPR it forms the UK's data protection framework. It was substantially amended by the Data (Use and Access) Act 2025, which also turned the Information Commissioner's Office into the Information Commission from 30 September 2026.
Read the breakdown →The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is commencing in stages. Part 2, in force from 1 December 2025 (except sections 45 to 48), puts the UK digital verification services trust framework and register on a statutory footing. Most amendments to the UK GDPR, Data Protection Act 2018 and PECR commenced on 5 February 2026, and the ICO became the Information Commission on 30 September 2026.
Read the breakdown →