United Kingdom: compliance overview

1 regulations, 8 mapped obligations and 2 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind us Contact an advisor

Regulatory timeline: what comes next

2025-06-19
Data (Use and Access) Act 2025 receives Royal Assent; a small number of provisions commence immediately
UK data protection regime (UK GDPR and DPA 2018 as amended by the Data (Use and Access) Act 2025)
2026-02-05
Core data protection amendments commence: new automated decision-making rules, recognised legitimate interests, purpose limitation, and the international transfer “data protection test”
UK data protection regime (UK GDPR and DPA 2018 as amended by the Data (Use and Access) Act 2025)
2026-06-19
Statutory data-subject complaints route to controllers commences
UK data protection regime (UK GDPR and DPA 2018 as amended by the Data (Use and Access) Act 2025)

Applicable regulations (1)

Phased applicationData & privacyRelevance Critical

UK data protection regime (UK GDPR and DPA 2018 as amended by the Data (Use and Access) Act 2025)

A Chinese AI company is caught if any of the following applies: (1) it has a UK subsidiary, branch or R&D site, or UK employees whose personal data it processes; (2) it has no UK entity but offers SaaS, model APIs, smart hardware or robotics services to individuals in the UK (paid or free) and processes their personal data; (3) it monitors the behaviour of individuals in the UK — analytics/cookies/SDK profiling, camera or sensor capture of UK users, recommendation or risk scoring of UK users; (4) it acts as processor for a UK customer, training models, labelling data or serving inference from China or a third country — the customer’s transfer to it is a restricted transfer, and it must support the IDTA/Addendum and the data protection test. Companies with no UK entity that fall within (2) or (3) must also assess whether an Article 27 UK representative is required.

8 obligations · reviewed 2026-09-12

Data transfer routes

UK International Data Transfer Agreement (IDTA) and Addendum to the EU SCCs
No volume threshold. Any restricted transfer from the UK to a separate organisation abroad that is not covered by UK adequacy regulations and cannot use an exception (a derogation in the legislation) needs an appropriate safeguard, and the IDTA or the Addendum are the two usual ones. Watch the terminology shift: the Data (Use and Access) Act 2025 renamed the transfer risk assessment in the legislation as the "data protection test", while ICO guidance still uses TRA; and the standard is expressed in ICO guidance as the protection for people’s information being "not materially lower" after the transfer. On versions, the ICO guidance (page DC.Date metadata 15 Jan 2026) states verbatim: "We plan to update the IDTA and Addendum in the course of 2026. You should continue to use the current versions." The current templates are IDTA A.1.0 and Addendum B.1.0, laid before Parliament under s119A of the Data Protection Act 2018 on 2 February 2022, and Section 5.4 of the IDTA and Section 18 of the Addendum let the parties opt into automatic updating when the ICO issues a new version.
Lead time: Estimate: 2-4 weeks for a single vendor including the TRA; 1-2 weeks where EU SCCs already exist and only the Addendum needs to be layered on. · Cost band Medium
UK adequacy regulations (data bridges, including the UK Extension to the DPF)
No volume threshold. Three points must be got right: (1) the UK adequacy regulations for the US are made independently by the UK government and cover only personal information transferred under the UK Extension to the DPF (the UK-US data bridge); they are a separate instrument from the EU’s Decision (EU) 2023/1795 - so a change on the EU side of the DPF, including the outcome of the appeal in C-703/25 P, does not automatically end the UK route, or vice versa, and both must be tracked separately; (2) transfers under adequacy regulations need no transfer risk assessment and no appropriate safeguard, though the ICO is explicit that you should still make reasonable and proportionate checks that the recipient complies with its local data protection obligations; (3) the UK list differs from the EU list - Gibraltar is on the UK list but not the EU one, and the mutual EU-Brazil adequacy of early 2026 does not appear on the ICO page - so never map one list onto the other when operating across both regimes.
Lead time: Estimate: 1-3 working days for verification and documentation. · Cost band Low

What you can use right now

Playbooks

EU enterprise due diligence and tenders: a 48-hour response mechanism

Templates

GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses AI incident and serious incident reporting record (register plus report drafts)ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outline Greenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)ISO/IEC 42001 AI management system implementation and certification readiness checklist Third-party sustainability assurance readiness checklist (starting from limited assurance)

Relevant standards

IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information · IFRS S1 (issued June 2023; not amended as at 12 September 2026 — the December 2025 greenhouse gas emissions amendments apply only to IFRS S2)
IFRS S2 Climate-related Disclosures · IFRS S2 (issued June 2023; amended by the December 2025 Amendments to Greenhouse Gas Emissions Disclosures, effective for annual reporting periods beginning on or after 1 January 2027)
ISO/IEC 42001 Artificial Intelligence Management System (AIMS) · ISO/IEC 42001:2023 (edition 1, dated 2023-12); European adoption EN ISO/IEC 42001:2026
ISO/IEC 42006:2025 Requirements for bodies providing audit and certification of AI management systems · ISO/IEC 42006:2025 (edition 1, dated 2025-07)
ISO/IEC 23894:2023 Artificial intelligence — Guidance on risk management · ISO/IEC 23894:2023 (edition 1, dated 2023-02)
ISO/IEC 22989:2022 Artificial intelligence concepts and terminology · ISO/IEC 22989:2022 (edition 1, 2022-07-19; European adoption EN ISO/IEC 22989:2023)
ISO/IEC 27001:2022 Information security management systems — Requirements · ISO/IEC 27001:2022 (edition 3, 2022-10); European adoption EN ISO/IEC 27001:2023, including Amendment A1:2024
ISO/IEC 27002:2022 Information security controls · ISO/IEC 27002:2022 (2022-02-15; European adoption EN ISO/IEC 27002:2022, including Corrigendum AC:2024)
ISO/IEC 27701:2025 Privacy information management systems — Requirements and guidance · ISO/IEC 27701:2025 (edition 2, 2025-10), cancelling and replacing ISO/IEC 27701:2019

Sources (14)

Data (Use and Access) Act 2025 — official textThe National Archives / legislation.gov.uk · 2025 c. 18 · published 2025-06-19 · retrieved 2026-09-12
Data (Use and Access) Act 2025, section 142 (Commencement)The National Archives / legislation.gov.uk · s. 142 · published 2025-06-19 · retrieved 2026-09-12
Data (Use and Access) Act 2025, section 80 (Automated decision-making; new UK GDPR Articles 22A–22D)The National Archives / legislation.gov.uk · s. 80 · published 2025-06-19 · retrieved 2026-09-12
Data (Use and Access) Act 2025, section 78 (Searches in response to data subjects’ requests)The National Archives / legislation.gov.uk · s. 78 · published 2025-06-19 · retrieved 2026-09-12
Data (Use and Access) Act 2025, section 103 (Complaints by data subjects; new DPA 2018 s. 164A)The National Archives / legislation.gov.uk · s. 103 · published 2025-06-19 · retrieved 2026-09-12
Data (Use and Access) Act 2025, Schedule 7 (Transfers of personal data to third countries: general processing)The National Archives / legislation.gov.uk · Sch. 7 · published 2025-06-19 · retrieved 2026-09-12
The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026The National Archives / legislation.gov.uk · S.I. 2026/82, regs. 2–3 · retrieved 2026-09-12
Data Protection Act 2018, section 157 (maximum amount of penalty: higher and standard maximum)The National Archives / legislation.gov.uk · s. 157(5)(6) · retrieved 2026-09-12
ICO — International transfers guidance hubInformation Commissioner’s Office (ICO) · retrieved 2026-09-12
ICO — Appropriate safeguards (including the UK IDTA and the Addendum)Information Commissioner’s Office (ICO) · published 2026-01-15 · retrieved 2026-09-12
ICO — Completing a transfer risk assessmentInformation Commissioner’s Office (ICO) · published 2026-01-15 · retrieved 2026-09-12
ICO — Automated decision-making, including profiling (draft detailed guidance)Information Commissioner’s Office (ICO) · published 2026-03-31 · retrieved 2026-09-12
ICO — Guidance on AI and data protectionInformation Commissioner’s Office (ICO) · published 2023-03-15 · retrieved 2026-09-12
ICO — Artificial intelligence guidance hub (AI risk toolkit, explaining AI decisions, biometric recognition)Information Commissioner’s Office (ICO) · retrieved 2026-09-12

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.