Browse tools

Law, policy and the UK

UK GDPR

In short

The UK GDPR is the UK's main data protection law. It is the EU's General Data Protection Regulation as kept in UK law after Brexit, setting rules for how organisations collect and use personal data, including to train and run AI.

Also called
United Kingdom General Data Protection Regulation, UK General Data Protection Regulation
Topic
Law, policy and the UK
Level
Beginner
First described
Adopted by the EU as the General Data Protection Regulation, Regulation (EU) 2016/679 of 27 April 2016, and kept as UK law after Brexit through the European Union (Withdrawal) Act 20181.

The Data Protection Act 2018 defines the UK GDPR as Regulation (EU) 2016/679 as it forms part of UK law under the European Union (Withdrawal) Act 20181. In practice it works alongside the 2018 Act, which fills in details and exemptions.

At its heart are seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability2. Any organisation using personal data, from a GP surgery to an AI developer, has to follow them.

Breaking the rules can be expensive. The higher maximum fine is £17.5 million or 4% of worldwide annual turnover, whichever is higher3.

The UK has since started to diverge from the EU. The Data (Use and Access) Act 2025 amended the UK GDPR, for example replacing the old Article 22 on automated decisions with Articles 22A to 22D, in force from 5 February 20264. The EU still treats UK protection as adequate: in December 2025 it renewed its adequacy decisions until 27 December 2031, so personal data can keep flowing from the EU to the UK5.

The UK GDPR does not regulate AI as such. It applies whenever an AI system processes personal data, such as names, photos or chat logs. The ICO, which enforces it, publishes specific guidance on AI and data protection6.

Example

In 2022 the ICO fined Clearview AI £7.5 million for scraping images of UK residents from the web and social media into a facial recognition database. The case was still in the courts in late 20257.

Why it matters

It is the law that gives you rights over your personal data, including data used by chatbots and other AI tools, and it sets the limits on what companies can do with it.

Questions people ask

Is the UK GDPR the same as the EU GDPR?

It started as a copy, but they now differ. The Data (Use and Access) Act 2025 changed the UK version, including its rules on automated decisions4. The EU still regards UK protection as adequate under decisions renewed until December 20315.

Does the UK GDPR apply to AI?

Yes, whenever an AI system uses personal data, whether in training or in use. The ICO publishes guidance on applying UK GDPR principles to AI6.

What is the maximum fine under the UK GDPR?

For the most serious breaches, £17.5 million or 4% of a company's total worldwide annual turnover in the previous year, whichever is higher3.

Related terms

Data (Use and Access) Act 2025 Information Commissioner's Office Automated decision-making AI and privacy EU AI Act Web scraping for AI

Sources

  1. Data Protection Act 2018, section 3(10), definition of 'the UK GDPR', legislation.gov.uk
  2. ICO, A guide to the data protection principles
  3. Data Protection Act 2018, section 157 (maximum amount of penalty), legislation.gov.uk
  4. Data (Use and Access) Act 2025, section 80, with in-force note for S.I. 2026/82
  5. Hunton Andrews Kurth (2025), European Commission renews UK data adequacy decisions
  6. ICO, Artificial intelligence guidance hub
  7. ICO (8 October 2025), UK Upper Tribunal hands down judgment on Clearview AI Inc (updated 19 December 2025)

Back to the glossary