What Is UK GDPR and How It Differs From EU GDPR

UK GDPR is the United Kingdom's own version of the General Data Protection Regulation, in force since 1 January 2021 when the Brexit transition period ended. It sits alongside the Data Protection Act 2018 rather than the EU regulation, and the two frameworks have quietly diverged on points that matter to vendor due diligence, including who supervises a vendor, what currency its maximum fine is set in, and which transfer mechanism covers personal data leaving the country. For a buyer running a vendor security review, the practical question is not whether a supplier claims broad 'GDPR compliance', it is whether the supplier's public evidence treats the UK and the EU as two separate legal regimes or quietly assumes one covers the other.

UK GDPR is retained EU law. When the UK left the EU, the text of the EU General Data Protection Regulation was copied into UK domestic law under the European Union (Withdrawal) Act 2018, then amended by UK-specific regulations so the wording made sense outside the EU: references to the European Commission became references to the Secretary of State, and references to EU member states were removed or reworked. The result is a UK statute instrument that reads almost identically to the EU regulation on its face, enforced by the Information Commissioner's Office (ICO) rather than any EU data protection authority. CertReports tracks the two as separate entries: UK GDPR vendor evidence sits apart from GDPR vendor evidence, and the regulation pages set out what UK GDPR asks of vendors alongside what GDPR asks of vendors.

UK GDPR does not stand alone. It works together with the Data Protection Act 2018 (DPA 2018), which was itself amended after Brexit to keep pace with the retained regulation. The DPA 2018 fills in detail that the regulation leaves to national law: exemptions for law enforcement, immigration control, journalism and legal privilege; criminal offences for unlawfully obtaining or re-identifying personal data; and the ICO's enforcement powers, including the ability to issue fines, enforcement notices and assessment notices. A vendor that only mentions 'GDPR' in its documentation, without naming either the DPA 2018 or the UK GDPR, has not actually told a UK buyer which domestic law it is relying on for exemptions, breach notification timing, or data subject rights handling in the UK.

Diagram comparing the legal structure of EU GDPR and UK GDPR side by side — EU GDPR and UK GDPR now run as two separate legal regimes with their own transfer tools and supervisory authorities.

What changed when the UK left the EU

On paper, the substantive rules barely moved on exit day: the same lawful bases, the same data subject rights, the same breach notification window of 72 hours. What changed is everything around the edges. The UK set its own maximum fine in pounds rather than euros. The UK built its own list of adequacy decisions rather than relying on the European Commission's list, which is why the UK and the EU can, in principle, reach different conclusions about whether a given third country offers adequate protection. The UK also published its own international transfer tools rather than simply adopting the EU's updated Standard Contractual Clauses (SCCs) wholesale, since the 2021 EU SCCs were drafted for a regulation the UK no longer directly applies.

Aspect	EU GDPR	UK GDPR
Legal instrument	Regulation (EU) 2016/679, directly applicable across EU member states	Retained EU law under the Data Protection Act 2018 framework, as amended for exit
Supervisory authority	National data protection authorities, coordinated through the European Data Protection Board	The Information Commissioner's Office (ICO)
Maximum fine	Twenty million euro or 4% of global annual turnover, whichever is higher	Seventeen point five million pounds or 4% of global annual turnover, whichever is higher
International transfer tool for new contracts	European Commission Standard Contractual Clauses, 2021 version	International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs
Adequacy decisions	Issued by the European Commission, covering named third countries	Issued separately by UK government ministers, including the UK's own data bridge arrangements
US transfer framework	EU-US Data Privacy Framework	UK extension to the Data Privacy Framework, often called the UK-US Data Bridge

Core differences between EU GDPR and UK GDPR that show up in vendor contracts and trust centres.

Article 5 of UK GDPR sets out seven principles that every processing activity has to satisfy. They are the same seven principles found in Article 5 of EU GDPR, because the wording was copied across on exit day and has not been substantively rewritten since.

Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality, commonly called the security principle
Accountability

1 Jan 2021
UK GDPR took effect: The end of the Brexit transition period, when retained EU law including the UK GDPR became directly applicable; 7
Data protection principles: Set out in Article 5 of both UK GDPR and EU GDPR, with wording that started out identical at the point of exit; £17.5m
Maximum UK GDPR fine: Or 4% of global annual turnover, whichever is higher, under the ICO's powers in the Data Protection Act 2018

The UK GDPR sits alongside an amended version of the Data Protection Act 2018, which complements the UK GDPR, for example by providing exemptions.
— Information Commissioner's Office (ICO)

Why vendors need separate transfer mechanisms

This is where the divergence becomes practical rather than academic. From 21 September 2022, the ICO required new UK data transfer agreements to use either its own International Data Transfer Agreement (IDTA) or the UK Addendum attached to the EU's 2021 SCCs. A vendor that updated its contracts for the EU's SCC changes in 2021 but never added the UK Addendum has a gap: its EU transfer paperwork does not, on its own, cover personal data originating in the UK. The same split applies to the Data Privacy Framework. The EU-US Data Privacy Framework and the UK extension to it, agreed separately in 2023, are listed independently on the US Department of Commerce's register, and a vendor can be verified for one without the other. What the EU-US Data Privacy Framework actually certifies is worth reading alongside this point, because 'DPF verified' in a trust centre often means the EU listing only, and the UK extension needs checking separately.

None of this means a vendor is doing anything wrong by handling the UK and EU as one programme internally. It means a buyer should not assume a single 'GDPR compliant' badge, a phrase that has no legal meaning since there is no general GDPR certification scheme, covers both regimes just because the vendor only mentions one. What GDPR compliance actually means and what a vendor can show you sets out the kinds of evidence that do exist, which is a more useful question than chasing a label that does not.

Intercom's trust centre is a useful example of what to look for, rather than what to assume. It runs on a Vanta-hosted set of framework pages, carries an active Data Privacy Framework listing, and publishes a subprocessor list. That combination is exactly where a buyer should check whether the DPF listing extends to the UK bridge or covers the EU only, and whether the subprocessor list or the underlying data processing agreement separately names the UK Addendum alongside the EU SCCs. The card below renders live data, so check the current state of the listing and the subprocessor list rather than relying on this description.

Intercom · Trust report

Customer support · Public evidence as of 12 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.

2 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.

Subprocessor list · Public
Privacy policy · Public

1Security practices

Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.

Penetration testing · annual

14Subprocessors

Named on Intercom's public subprocessor list, last seen 30 Sep 2026.

Intercom's current trust centre listing in the CertReports index. Every line is a dated public record from the Data Privacy Framework list and Intercom's trust centre. A framework not shown means no public evidence was found, not that Intercom lacks it.CertReports

Checklist graphic for verifying a vendor's UK and EU GDPR transfer evidence — A short checklist for confirming separate UK and EU transfer coverage before sign-off.

1
Find the vendor's data processing agreement or trust centre
Look for a standalone document rather than a single sentence inside the main terms of service.
2
Check whether UK GDPR appears separately from GDPR
A vendor that lists both on its trust centre, or in its DPA schedules, is telling you it has thought about the split rather than assuming one regime covers the other.
3
Look for the IDTA or UK Addendum, not just SCCs
EU Standard Contractual Clauses on their own do not satisfy UK transfer requirements for contracts signed after the ICO's cutover date.
4
Check the Data Privacy Framework listing scope
Confirm whether the listing names the UK extension alongside the EU framework, since the two are verified separately on the US register.
5
Review the subprocessor list for UK-relevant detail
Checking a vendor's subprocessor list for data location and transfer basis is often faster than reading the full DPA.
6
Note the supervisory authority named in the contract
A contract that names only an EU data protection authority, with no mention of the ICO, has not addressed the UK relationship at all.

Common mistakes buyers make

Assuming the EU's adequacy decision for a third country automatically applies under UK GDPR, when the UK maintains its own separate adequacy list
Treating EU SCCs as sufficient for UK transfers without checking for the IDTA or UK Addendum
Reading a vendor's claim of being 'GDPR certified' at face value, when no general certification scheme for GDPR exists and the correct evidence is a DPA, SCCs or IDTA, and a subprocessor list
Assuming a DPF listing automatically includes the UK extension, rather than checking the register entry directly
Skipping the question of which supervisory authority, the ICO or an EU data protection authority, actually has jurisdiction over a given complaint

Start from the regulations that actually apply

If you are not sure whether UK GDPR, EU GDPR, or both apply to a given vendor relationship, run the vendor through the regulations that apply and what your vendors evidence tool before chasing individual contract clauses.

What Is UK GDPR and How It Differs From EU GDPR

What changed when the UK left the EU