UK GDPR versus EU GDPR: which rules apply?

Part of the guide UK GDPR’s seven principles, in plain English

UK GDPR covers personal data used in connection with a UK establishment’s activities. That can apply even when the processing takes place elsewhere.

It can also cover a business outside the UK. The relevant activity must involve offering goods or services to people in the UK, or monitoring behaviour that takes place here. A service can be free and still meet the offering test.

EU GDPR covers processing connected with an EU establishment’s activities. It can also reach an organisation outside the EU when the relevant activity involves offering goods or services to people there, or monitoring their behaviour there.

The European Economic Area, or EEA, includes the EU countries plus Iceland, Liechtenstein and Norway. The ICO’s guidance covers businesses operating in or targeting this wider area.

These fictional examples show the questions to ask. They are starting points for a scope review, not conclusions about every part of a business.

Which activity needs a closer look? Illustrative examples
Business activity	What to check
A UK shop sends orders to customers it targets in Ireland	UK establishment and EU customer targeting may bring both laws into play.
A UK firm runs an office in France	Check processing connected with that EU establishment, wherever the processing occurs.
A UK website tracks behaviour of people in Germany	Check whether the relevant processing monitors behaviour taking place in the EU.

The scope tests have a similar structure, but they are separate rules. Check each relevant business activity against each law. A server’s location alone does not settle the question.

A short comparison for a UK business
Question	UK GDPR	EU GDPR
Is there a relevant establishment?	Processing connected with a UK establishment can be covered.	Processing connected with an EU establishment can be covered.
Can a business outside the territory be covered?	Yes, through relevant UK offering or behaviour monitoring.	Yes, through relevant EU offering or behaviour monitoring.
Must customers pay?	No, the offering test can include free services.	No, the offering test can include free services.
Can both laws apply?	Yes. Check each activity.	Yes. Being based in the UK does not rule this out.

Does EU adequacy mean the laws are the same?

No. Adequacy means the EU recognises a sufficient level of data protection for the transfers it covers. The UK has EU adequacy, renewed in December 2025. That can allow information to flow from the EEA without extra transfer safeguards.

It does not turn the two laws into one. The ICO gives an example where adequacy supports transfers in both directions, but each transfer sits under a different data protection regime.

Ask two separate questions

Which law covers the activity?

Consider the relevant UK or EU establishment.
For activity outside the territory, check offering and behaviour monitoring.

How can information be transferred?

Map where information goes and who receives it.
Check whether the relevant transfer is covered by adequacy.

A permitted transfer does not decide all the legal duties for using the information.

Map your data flows so you’re clear about which data protection regime applies to which transfers.

Do you need an EEA representative?

A UK organisation with no EEA base may need a representative there when EU GDPR applies to its offering or monitoring activities. Having one does not remove the organisation’s own responsibility.

There is an exception for occasional processing, but being occasional is not enough. The processing must also be unlikely to risk people’s rights and freedoms. It must not include large scale use of special category or criminal offence information. Public authorities have a separate exception.

Where a representative is required, the relevant location matters. It must be in a member state where some of the affected people are located.

Where do automated decision rules differ?

EU GDPR generally protects people from significant decisions based solely on automated processing. Its exceptions include contract necessity, explicit consent and legal authorisation with safeguards.

The UK now has a different structure. It retains a specific restriction for significant, solely automated decisions involving special category data. Its safeguards require information, a way to put your case, human intervention and a way to contest the decision.

If both laws cover an activity, a UK check alone will not settle the EU position. Review the decision under each relevant regime.

What to do

List the activities connected with UK and EU establishments.
Identify where goods or services are offered and where monitored behaviour takes place.
Map transfers separately from the scope review.
Check whether a representative is required, including the full conditions for an exception.

Common questions

Can a UK business follow both sets of rules?

Yes. The ICO gives an example of a Belfast company targeting customers in the UK and Ireland, where both regimes apply.

Does keeping data on a UK server settle the position?

No. The establishment tests can apply regardless of where processing takes place. Offering and monitoring activities can also bring an organisation outside the territory within scope.

Does every UK website need an EU representative?

No. The obligation depends on whether the relevant EU scope rule applies, and exceptions have conditions. Review the activity rather than assuming that every website has the same duty.

Where next

Sources

This is an independent editorial guide, not legal advice.

When does UK GDPR apply?

When can EU GDPR apply to a UK business?

UK GDPR versus EU GDPR: the practical comparison