Home › Answers › Data, privacy and GDPR
What is UK GDPR, and does the UK still follow GDPR?
Short answer
UK GDPR is the UK's own version of the EU General Data Protection Regulation, kept in UK law after Brexit and read alongside the Data Protection Act 2018. It sets the rules for using personal information, including in AI tools. The Data (Use and Access) Act 2025 updated it, with most changes in force from 5 February 2026.
The key rules in one table
| Principle | What it means for a small business using AI |
|---|---|
| Lawful, fair and transparent | Have a lawful basis and tell people how you use their data, including AI |
| Purpose limitation | Only use data for the reasons you collected it |
| Data minimisation | Don't paste more personal data into AI tools than you need |
| Accuracy | Check AI output about people |
| Storage limitation | Delete chats and files you no longer need |
| Security | Use business plans, strong passwords and two-factor sign-in |
| Accountability | Keep records, and do a DPIA for high-risk uses |
What changed in 2026
- The Data (Use and Access) Act 2025 eased some rules on automated decision-making and added "recognised legitimate interests".
- From 5 February 2026, the ICO can fine up to £17.5 million or 4% of turnover for marketing breaches under PECR.
- From 19 June 2026, organisations must have a process for handling data protection complaints.
Is UK GDPR the same as EU GDPR?
Very close, but they're now separate laws. If you sell to people in the EU, EU GDPR can apply too.
Related questions
Related questions
Is UK GDPR a law?
Yes. It's retained law in the UK, and the Data Protection Act 2018 sits alongside it.
Does GDPR apply to sole traders?
Yes, if you use personal data for business, such as customer names, numbers and addresses.
Is a payroll number personal data under GDPR?
Yes. An employee or payroll number identifies a person, so it is personal data even without a name attached. Keep payroll records secure and share them only with people who need them, such as your payroll provider.
Sources
- GOV.UK: data protection
- ICO: statement on the commencement of the Data (Use and Access) Act (5 February 2026)
- GOV.UK: Data (Use and Access) Act 2025, plans for commencement
- ICO: what is personal data?
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can AI read my WhatsApp messages?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.