# UK GDPR versus EU GDPR: which rules apply? A UK address does not settle which data protection law covers every part of your business. The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026. Part of the guide [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md). **The short answer.** A UK business may need to follow both UK GDPR and EU GDPR. Start with where it operates and whether it offers services to, or monitors, people in the EU. Data transfers are a separate question ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3), [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504) and [ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). ## When does UK GDPR apply? UK GDPR covers personal data used in connection with a UK establishment’s activities. That can apply even when the processing takes place elsewhere ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3), checked 9 October 2026). It can also cover a business outside the UK. The relevant activity must involve offering goods or services to people in the UK, or monitoring behaviour that takes place here. A service can be free and still meet the offering test ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3), checked 9 October 2026). ## When can EU GDPR apply to a UK business? EU GDPR covers processing connected with an EU establishment’s activities. It can also reach an organisation outside the EU when the relevant activity involves offering goods or services to people there, or monitoring their behaviour there ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). The European Economic Area, or EEA, includes the EU countries plus Iceland, Liechtenstein and Norway. The ICO’s guidance covers businesses operating in or targeting this wider area ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). These fictional examples show the questions to ask. They are starting points for a scope review, not conclusions about every part of a business ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). **Which activity needs a closer look? Illustrative examples** | Business activity | What to check | | --- | --- | | A UK shop sends orders to customers it targets in Ireland | UK establishment and EU customer targeting may bring both laws into play. | | A UK firm runs an office in France | Check processing connected with that EU establishment, wherever the processing occurs. | | A UK website tracks behaviour of people in Germany | Check whether the relevant processing monitors behaviour taking place in the EU. | Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/3 (checked 9 October 2026); EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504 (checked 9 October 2026); ICO, Receiving personal information from the EEA, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/ (checked 9 October 2026) ## UK GDPR versus EU GDPR: the practical comparison The scope tests have a similar structure, but they are separate rules. Check each relevant business activity against each law. A server’s location alone does not settle the question ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). **A short comparison for a UK business** | Question | UK GDPR | EU GDPR | | --- | --- | --- | | Is there a relevant establishment? | Processing connected with a UK establishment can be covered. | Processing connected with an EU establishment can be covered. | | Can a business outside the territory be covered? | Yes, through relevant UK offering or behaviour monitoring. | Yes, through relevant EU offering or behaviour monitoring. | | Must customers pay? | No, the offering test can include free services. | No, the offering test can include free services. | | Can both laws apply? | Yes. Check each activity. | Yes. Being based in the UK does not rule this out. | Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/3 (checked 9 October 2026); EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504 (checked 9 October 2026); ICO, Receiving personal information from the EEA, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/ (checked 9 October 2026) ## Does EU adequacy mean the laws are the same? No. Adequacy means the EU recognises a sufficient level of data protection for the transfers it covers. The UK has EU adequacy, renewed in December 2025. That can allow information to flow from the EEA without extra transfer safeguards ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). It does not turn the two laws into one. The ICO gives an example where adequacy supports transfers in both directions, but each transfer sits under a different data protection regime ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). **Ask two separate questions** - **Which law covers the activity?** - Consider the relevant UK or EU establishment. - For activity outside the territory, check offering and behaviour monitoring. - **How can information be transferred?** - Map where information goes and who receives it. - Check whether the relevant transfer is covered by adequacy. A permitted transfer does not decide all the legal duties for using the information. Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/3 (checked 9 October 2026); EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504 (checked 9 October 2026); ICO, Receiving personal information from the EEA, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/ (checked 9 October 2026) > "Map your data flows so you’re clear about which data protection regime applies to which transfers." > ICO, UK and EU guidance > ICO, Receiving personal information from the EEA, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/ (checked 9 October 2026) ## Do you need an EEA representative? A UK organisation with no EEA base may need a representative there when EU GDPR applies to its offering or monitoring activities. Having one does not remove the organisation’s own responsibility ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504) and [ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). There is an exception for occasional processing, but being occasional is not enough. The processing must also be unlikely to risk people’s rights and freedoms. It must not include large scale use of special category or criminal offence information. Public authorities have a separate exception ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). Where a representative is required, the relevant location matters. It must be in a member state where some of the affected people are located ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). ## Where do automated decision rules differ? EU GDPR generally protects people from significant decisions based solely on automated processing. Its exceptions include contract necessity, explicit consent and legal authorisation with safeguards ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). The UK now has a different structure. It retains a specific restriction for significant, solely automated decisions involving special category data. Its safeguards require information, a way to put your case, human intervention and a way to contest the decision ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/22B) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/22C), checked 9 October 2026). If both laws cover an activity, a UK check alone will not settle the EU position. Review the decision under each relevant regime ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/22B), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/22C) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). ## What to do 1. List the activities connected with UK and EU establishments ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). 2. Identify where goods or services are offered and where monitored behaviour takes place ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). 3. Map transfers separately from the scope review ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). 4. Check whether a representative is required, including the full conditions for an exception ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504) and [ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). ## Common questions ### Can a UK business follow both sets of rules? Yes. The ICO gives an example of a Belfast company targeting customers in the UK and Ireland, where both regimes apply ([ICO, Receiving personal information from the EEA](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/), checked 9 October 2026). ### Does keeping data on a UK server settle the position? No. The establishment tests can apply regardless of where processing takes place. Offering and monitoring activities can also bring an organisation outside the territory within scope ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/3) and [EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). ### Does every UK website need an EU representative? No. The obligation depends on whether the relevant EU scope rule applies, and exceptions have conditions. Review the activity rather than assuming that every website has the same duty ([EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504), checked 9 October 2026). ## Where next - [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md) - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md) - [Automated decisions: what UK GDPR now requires](https://theassurancedesk.com/guides/automated-decisions-uk-gdpr.md) ## Sources - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/3 (checked 9 October 2026) - EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), consolidated text of 4 May 2016: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504 (checked 9 October 2026) - ICO, Receiving personal information from the EEA: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/ (checked 9 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/22B (checked 9 October 2026) - legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/22C (checked 9 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.