Regulation (EU) 2016/679 (UK GDPR) · Last verified
UK GDPR
The UK GDPR is Regulation (EU) 2016/679 as it applies in UK law; Article 3 scope and the Article 83 fine ceilings are reproduced verbatim here. It is the EU regulation's text as adapted for UK law (amendments applied 31 December 2020), reproduced in its own wording with article numbers and source links — this page does not interpret it.
- Citation
- Regulation (EU) 2016/679 (UK GDPR)
- Jurisdiction
- GB
- Regulator
- Information Commissioner's Office (ICO)
- Last verified
What it is
It is the EU regulation's text as adapted for UK law (amendments applied 31 December 2020), reproduced in its own wording with article numbers and source links — this page does not interpret it.
Key dates
- EU-exit amendments to this text applied: —
legislation.gov.uk change note on Article 3: The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419)
Scope
Article 3 — Territorial scope (revised text)
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not.
2. This Regulation applies to the relevant processing of personal data of data subjects who are in the United Kingdom by a controller or processor not established in the United Kingdom, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the United Kingdom; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom.
2A. In paragraph 2, “relevant processing of personal data” means processing to which this Regulation applies, other than processing described in Article 2(1)(a) or (b) or (1A).
3. This Regulation applies to the processing of personal data by a controller not established in the United Kingdom, but in a place where domestic law applies by virtue of public international law.
Penalties
Article 83(4) (revised text)
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to £8,700,000, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher
Article 83(5) (revised text)
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to £17,500,000, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher
How this text names the 2018 Act
Article 4(A1) (revised text)
‘the 2018 Act’ means the Data Protection Act 2018;
Pending changes
The Data (Use and Access) Act 2025 (c. 18, Royal Assent 19 June 2025) amends this instrument; commencement is staged, and legislation.gov.uk lists outstanding changes not yet in force. The revised text read for this record is stated by legislation.gov.uk to be up to date with changes in force on or before 5 September 2026.
Sources
Last verified:
This page is for information only and is not legal advice. It reproduces the regulation's own wording; always confirm against the primary source linked above and consult qualified counsel for how it applies to your organisation.