UK: the new data law drifts from the GDPR without breaking

On 30 September 2026, the United Kingdom abolished the office of Information Commissioner. Its functions passed to a new body with a board, the Information Commission, whose staff keep the ICO name (United Kingdom · DCMS, SI 2026/1015 of 10 September 2026). It is the latest step of the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025 and was brought into force by nine successive commencement regulations over fourteen months. Since 19 June 2026, all of its data protection provisions apply, according to the regulator.

The UK has not left the GDPR: it has written a British version of it. The European Union judged the gap acceptable and renewed its adequacy finding until 2031. But the differences touch very practical matters: cookies, automated decisions, lawful basis. What is allowed in London is not necessarily allowed in Paris.

What is now in force

• The core of the reform (United Kingdom · DSIT): most changes to the UK GDPR and the Data Protection Act 2018 have applied since 5 February 2026 (SI 2026/82).
• Recognised legitimate interests (United Kingdom · DUAA, Schedule 4): five purposes exempt from balancing against individuals’ rights: disclosure to a public body that needs it for its task, national security, public security and defence, emergencies, crime, safeguarding vulnerable individuals.
• Automated decisions (United Kingdom · ICO): a significant decision based solely on automated processing can now rely on a wider range of lawful bases, provided appropriate safeguards are in place. Special category data remains outside this relaxation.
• Cookies (United Kingdom · ICO): some cookies, used for statistical purposes or to improve a website’s functionality, can be set without consent, provided users are informed and can easily object.
• Penalties for cookies and direct marketing (United Kingdom · DUAA, Schedule 13): the ceiling now matches the UK GDPR, at £17.5 million or 4% of worldwide turnover.
• Complaints (United Kingdom · ICO): every organisation must help people complain, for example with an electronic form, acknowledge complaints within 30 days and respond without undue delay.
• Subject access requests (United Kingdom · ICO): only “reasonable and proportionate” searches are required.
• Transfers (United Kingdom · DUAA, Schedule 7): the government approves a third country by regulations if protection there is “not materially lower” than in the UK.
• Adequacy (EU · European Commission): renewed on 19 December 2025, valid until 27 December 2031, with a review after four years.

What is still pending

• The new governance (United Kingdom · Information Commission): the board took office on 30 September 2026 without a permanent chair; its deputy chair is acting in the interim. Recruitment is led by the department that took over sponsorship of the regulator after the break-up of DSIT, announced in July 2026 (United Kingdom · DCMS).
• Regulatory guidance (United Kingdom · Information Commission): new and updated guidance continues to be published.
• Smart data (United Kingdom · DUAA, Part 1): the regulation-making powers to organise sector-by-sector data sharing are in force; the schemes themselves still have to be created by regulations.
• The European review (EU · European Commission): a review of how the adequacy decisions function is planned after four years, with the European Data Protection Board.

The real issue: one group, two regimes

For a business on both sides of the Channel, adequacy settles the question of flows: data moves freely from the EU to the UK, at least until 27 December 2031. It does not settle the question of practices.

The same app can now measure its audience without consent in London and have to ask for it in Paris. In France, the exemption remains narrow: audience measurement solely on the publisher’s behalf, anonymous statistical data, no tracking across sites (France · CNIL). The same automated CV-screening tool can rely in the UK on a lawful basis with safeguards, while Article 22 of the GDPR (EU) frames it more strictly. Adequacy protects the flows, not the practices.

Three points to watch

1. Flexibilities do not travel. Processing designed in the UK on a recognised legitimate interest or a cookie exemption cannot be copied as is in the EU. Shared websites and apps need country-level settings.

2. Safeguards for automated decisions must be real. Information for the individual, the chance to make representations, human intervention and the right to contest: the relaxation only holds if these safeguards work in practice and are documented.

3. Adequacy under watch. The renewal took the reform into account, but London can now approve its own third countries. EU-origin data later transferred out of the UK deserves particular traceability, especially as the European review will look at these developments.

What a group operating in the UK and the EU must do

1. List UK processing that relies on a new flexibility: recognised legitimate interest, automated decision, exempt cookie.
2. Separate consent settings by country on shared websites and apps.
3. Document every significant automated decision: lawful basis, safeguards, route to contest, human review.
4. Set up the UK complaints process: form, acknowledgement within 30 days, tracking of responses.
5. Update documents: notices, records, contracts and procedures that still refer to the Information Commissioner.
6. Trace the origin of data before any transfer from the UK to a country approved by London but not by Brussels.
7. Reassess penalty exposure on direct marketing and cookies, now capped at £17.5 million.

The UK has not left the GDPR: it has made a local version of it. Manage it as such.

The question to ask on Monday morning

To your group data protection officer: “Which UK processing operations already rely on a flexibility the EU GDPR does not allow, and are they kept separate from our processing in the EU?”