Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Post-Brexit UK data protection runs on 'UK GDPR' (the onshored EU GDPR) plus the Data Protection Act 2018, enforced by the ICO with fines up to £17.5m/4% of global turnover; the UK sits outside NIS2 and instead relies on its own 2018 network-security regime, currently being overhauled by the Cyber Security and Resilience Bill.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
The EU GDPR as retained and onshored into UK law after Brexit, sitting alongside the Data Protection Act 2018. Substantively mirrors EU GDPR's principles, rights, and obligations, with UK-specific institutional references (ICO instead of EU supervisory authorities).
SourceThe UK's primary domestic data protection statute. Implements UK GDPR derogations, sets out the ICO's powers (including fining structure), and covers areas outside GDPR's scope such as law enforcement and intelligence services processing.
SourceThe UK's transposition of the EU's original NIS Directive (not NIS2, which post-dates Brexit). Applies to operators of essential services (energy, transport, health, drinking water, digital infrastructure) and relevant digital service providers, with the NCSC acting as the UK's CSIRT.
SourceGoverns cookies, direct marketing, and electronic communications. The Data (Use and Access) Act 2025, with core provisions commencing 5 February 2026, raised PECR's maximum fine roughly 35-fold to match UK GDPR levels, previously capped at £500,000.
Source72 hours
Controllers must notify the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach that poses a risk to individuals' rights and freedoms, identical to the EU GDPR standard, since UK GDPR was a direct onshoring of Article 33. Information can be provided in phases if the full picture isn't known within 72 hours.
Notify: ICO
SourcePublished legal maximums, not a personalized estimate, not legal advice.
UK GDPR / Data Protection Act 2018
£17.5 million or 4% of annual global turnover, whichever is greater (higher maximum)
Two-tier structure: a 'higher maximum amount' of £17.5m or 4% of global turnover for the most serious infringements, and a lower 'standard maximum amount' of £8.7m or 2% of global turnover for other infringements, whichever figure is higher applies in each tier.
SourcePECR (post-DUAA 2025 reform)
£17.5 million or 4% of global annual turnover, whichever is higher
As of the Data (Use and Access) Act 2025's commencement on 5 February 2026, PECR penalties (cookies, electronic marketing) were raised from a £500,000 cap to match UK GDPR fine levels.
SourceNot applicable , as of 2026-09-08
NIS2 is EU law and does not apply to the UK, which left the EU before NIS2 was adopted. The UK instead still runs the Network and Information Systems Regulations 2018, its transposition of the original 2016 NIS Directive. This regime is currently being overhauled by the Cyber Security and Resilience Bill, which will expand scope to cover data centres, managed service providers, and upstream critical suppliers.
SourceInformation Commissioner's Office(ICO)
Visit authority siteNo, the UK operates under 'UK GDPR,' a version of the EU GDPR retained and onshored into domestic law after Brexit, sitting alongside the Data Protection Act 2018. It closely mirrors EU GDPR's substance but is a legally distinct regime enforced solely by the ICO.
Up to £17.5 million or 4% of annual global turnover, whichever is greater, for the most serious infringements. A lower tier of £8.7 million or 2% of turnover applies to less severe administrative infringements.
No. NIS2 is EU law adopted after the UK's departure from the EU, so it has no direct application. UK critical-infrastructure operators instead remain subject to the Network and Information Systems Regulations 2018, being updated by the pending Cyber Security and Resilience Bill rather than replaced with NIS2.
Talk to us about scoping an engagement around your specific regulatory context.
