Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
UK GDPR
GDPR du Royaume-Uni et Data Protection Act 2018
La version du GDPR propre au Royaume-Uni après le Brexit, qui s'en écarte désormais sur certains points avec le Data (Use and Access) Act 2025.
The law in brief
The UK GDPR is the United Kingdom's version of the GDPR, kept in UK law after Brexit and read together with the Data Protection Act 2018. Its principles, legal bases and rights closely follow the EU text, so a GDPR program is a strong starting point, but UK-specific rules on transfers, the regulator and recent reforms now differ.
It is enforced by the Information Commissioner's Office (ICO).
À qui elle s’applique
- Organizations established in the UK, for processing in the context of that establishment.
- Organizations outside the UK that offer goods or services to people in the UK or monitor their behavior there; they may need a UK representative.
- It covers personal data about identified or identifiable living people; purely personal or household activity is outside it.
- Most organizations that process personal data must also pay a data protection fee to the ICO.
What it requires
A lawful basis for every use
Each purpose needs a lawful basis, as under the EU GDPR; the Data (Use and Access) Act adds recognized legitimate interests that need no balancing test.
Report breaches to the ICO within 72 hours
Report a personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people.
Transfers out of the UK
Send personal data outside the UK only under UK adequacy regulations, appropriate safeguards such as the International Data Transfer Agreement, or a listed exception.
Records, security and impact assessments
Keep records of processing, secure personal data appropriately, and carry out a data protection impact assessment before high-risk processing.
Droits des personnes
People have the same core rights as under the EU GDPR: to be informed, to access their data, to rectification and erasure, to restrict processing, to data portability, to object, and protections around automated decision-making. Requests are generally answered within one month.
Enforcement and penalties
Deux niveaux d’amendes : jusqu’à £17.5 millions ou 4% du chiffre d’affaires annuel mondial, le montant le plus élevé étant retenu, pour les infractions les plus graves, et jusqu’à £8.7 millions ou 2% pour les autres. L’ICO émet également des rappels à l’ordre, des mises en demeure et des avis d’évaluation.
What's changing
Reform under way. The Data (Use and Access) Act 2025 amends the UK GDPR and the Data Protection Act 2018, including recognized legitimate interests, more flexibility for automated decision-making with safeguards, new cookie exemptions, and a duty to handle complaints. Its provisions are coming into force in stages; check which apply now. Regulatory Watch reports each stage.
What to do first
- Start from your GDPR program, and note where UK rules differ.
- Pay the ICO data protection fee if you have not.
- Review transfers out of the UK and use the UK's own mechanisms, such as the International Data Transfer Agreement or the UK Addendum.
- Track the Data (Use and Access) Act changes as they come into force, and update notices, cookies and complaints handling.
- Keep 72-hour breach reporting to the ICO ready.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Évolutions récentes
Rien de signalé pour l’instant. Regulatory Watch recense les nouvelles règles, les mesures d’application et les décisions de justice au fur et à mesure.
Sources
- GDPR du Royaume-Uni (tel que conservé et modifié) legislation.gov.uk · Texte officiel ou régulateur
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles