PRIVACY COMPLIANCE · EU & UK GDPR
EU and UK GDPR Compliance Services
Data Mapping, DSARs, DPIAs, Transfers and Breach Readiness
Treating EU GDPR and UK GDPR as the same regulation with different flags stopped being safe in February 2026. The Data (Use and Access) Act 2025 rewrote parts of the UK regime, and its main data protection provisions came into force on 5 February 2026, with a statutory complaints duty following on 19 June 2026. Cookies, automated decision-making, lawful bases and subject access now differ between the two. Elevate Consult builds privacy programs that satisfy both without running them twice, and produces the evidence a supervisory authority asks for.
2026 UPDATE
What changed and what it means now
The UK regime diverged on 5 February 2026
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and commenced in stages. The main data protection provisions took effect on 5 February 2026, covering lawful bases, purpose limitation, automated decisions, international transfers, cookies and PECR penalties. The DUAA amends the UK GDPR and the Data Protection Act 2018 rather than replacing them, so a UK compliance program now has to cite all three instruments.
A statutory complaints duty applied from 19 June 2026
UK organizations processing personal data must have a data protection complaints process in place. There is no small business exemption. This is a process obligation rather than a documentation one: a privacy notice that mentions complaints does not satisfy it.
Solely automated decisions moved from prohibition to permission with safeguards
The UK replaced the previous ban on solely automated decisions with a permission-plus-safeguards model, and relaxed the special category data rules for such decisions in defined circumstances. The ICO announced it would review its automated decision-making guidance. The EU position is unchanged, so an organization operating in both now has two rules for the same processing.
UK cookie rules relaxed, EU rules did not
The DUAA exempts certain analytics cookies from the consent requirement where only aggregate, non-identifying data is collected. The EU continues to require prior consent for all non-essential cookies under ePrivacy and national implementations. A single cookie banner configuration no longer serves both markets correctly.
The EU-US Data Privacy Framework survived its first challenge
The EU General Court dismissed the Latombe challenge on 3 September 2025, confirming the validity of the adequacy decision. The decision was appealed to the Court of Justice of the EU with no hearing date set as of mid-2026. The framework remains valid, but given the history of Schrems I and II, organizations relying on it should keep Standard Contractual Clauses available as a fallback rather than retiring them.
UK adequacy was renewed
The European Commission renewed the UK adequacy decision in June 2025 for four years, so EU to UK transfers do not require SCCs or other safeguards while it holds. That is a dependency to monitor rather than a settled fact.
WHAT IT IS
Two regulations that no longer move together
The General Data Protection Regulation sets rules for processing the personal data of people in the EU, and the UK GDPR does the same for the UK. Both require transparency, a lawful basis, data subject rights, privacy by design and default, security of processing, vendor management and demonstrable governance.
Non-compliance carries fines up to 20 million euros or 4 percent of global annual turnover in the EU, and the higher of 17.5 million pounds or 4 percent in the UK, alongside corrective orders and reputational exposure. The substantive divergence introduced in 2026 sits in the operational layer rather than in the principles, which is why programs built on principles alone miss it.
WHO MUST COMPLY
Establishment, targeting and the processing chain
Scope reaches organizations established in the EU or UK for processing in the context of local activities, and organizations not established there that offer goods or services to EU or UK residents or monitor their behavior, including through analytics and advertising. It covers controllers, processors and subprocessors in the same chain, and applies to B2C and B2B personal data including employees, customers, prospects and end users. Organizations in scope without local establishment may need an EU or UK representative, and those are separate appointments.
Supervisory authority
EU: national DPAs. UK: the Information Commissioner
The DUAA also restructures UK regulator governance, so confirm the current body name in notices and contracts.
Maximum fines
EU: 20M EUR or 4 percent. UK: 17.5M GBP or 4 percent
Whichever is higher in each case.
Cookies and analytics
EU: consent for all non-essential. UK: certain analytics exempt
The UK exemption applies where only aggregate, non-identifying data is collected. One banner configuration no longer serves both.
Automated decisions
EU: restriction on solely automated decisions. UK: permission with safeguards
The UK moved to a permission-plus-safeguards model in February 2026 and relaxed special category rules in defined cases
Subject access
EU: unchanged. UK: reasonable and proportionate search
The UK codified the search standard and changed how the one-month response period is calculated.
International transfers
EU: SCCs plus TIAs, EU-US DPF. UK: IDTA or Addendum plus TIAs, UK Extension
The UK Extension to the Data Privacy Framework covers UK to US transfers to certified organizations.
OUR PROCESS
Scope, assess, remediate, operationalize
Elevate maps GDPR controls to CCPA and CPRA, ISO 27001, ISO 27701, SOC 2 and ISO 42001 so the evidence set answers multiple regimes instead of being rebuilt per regulation.
Readiness and gap assessment
Map scope across EU and UK entities, assess controls against both regimes, prioritize risk and deliver a remediation plan with a Records of Processing Activities starter.
Data mapping and RoPA
Build end-to-end inventories across systems, vendors and data flows, classify data and maintain the records rather than producing them once.
DSAR program
Design workflows, service levels, identity verification, redaction and search across SaaS and infrastructure, and implement request portals. Includes the UK reasonable and proportionate search standard.
DPIA and privacy by design
Risk screens, DPIA templates and reviews for high-risk processing, embedded into the SDLC and procurement rather than bolted on at launch.
International transfers
SCCs, IDTA and Addendum, Transfer Impact Assessments, vendor questionnaires and data residency strategy, with SCCs maintained as a fallback where DPF reliance exists.
Breach readiness
72-hour notification playbooks, table-top exercises, decision trees, templates and communications for both authorities and individuals.
Complaints process
The statutory UK complaints duty that applied from 19 June 2026: intake, triage, response and record, with no small business exemption.
DPO as a service
Outsourced DPO or privacy officer, regulator liaison and board-level reporting where an appointment is required or preferred.
Vendor risk and DPAs
Controller to processor agreements, security addenda, subprocessor review and ongoing monitoring.
Training and change management
Role-based training for product, marketing, HR, engineering and support, including AI and privacy.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to operationalize GDPR across both regimes?
Elevate Consult builds the roadmap, closes the gaps and stands up DSARs, DPIAs, consent, transfers, the UK complaints process and breach readiness, backed by evidence that holds up with a supervisory authority.
FAQ
Common Questions
Are EU GDPR and UK GDPR still the same?
No longer in practice. The core framework remains substantially aligned on principles, lawful bases, rights and fine structure, but the Data (Use and Access) Act 2025 introduced UK-specific changes to cookies, automated decision-making, subject access, lawful bases and transfers, with the main provisions in force from 5 February 2026. A program that treats them as identical will be wrong on cookies and on automated decisions at minimum.
What is the UK complaints duty?
A statutory requirement, applicable from 19 June 2026, for organizations processing personal data to have a data protection complaints process. There is no exemption for small businesses. It requires an actual intake, triage and response process with records, not a paragraph in a privacy notice.
Is the EU-US Data Privacy Framework still valid?
Yes. The EU General Court dismissed the Latombe challenge on 3 September 2025, confirming the adequacy decision. That decision has been appealed to the Court of Justice of the EU with no hearing date set as of mid-2026. Given Schrems I and Schrems II, organizations relying on the framework should keep Standard Contractual Clauses in place as a fallback rather than removing them.
When is a DPO required?
Where the organization is a public authority, where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large-scale processing of special category data. Many organizations outside those triggers still appoint a DPO or outsource the function, because the accountability principle requires someone to own it either way.
How fast must a breach be reported?
Notify the supervisory authority within 72 hours of becoming aware where the breach is likely to result in a risk to individuals, and notify affected individuals without undue delay where the risk is high. UK PECR breach notification was aligned to 72 hours in August 2025.
Do we need consent for analytics cookies?
In the EU, yes, for all non-essential cookies. In the UK the position changed: the DUAA exempts certain analytics cookies from consent where only aggregate, non-identifying data is collected. Organizations serving both markets need geo-aware consent configuration rather than a single banner, and should document which exemption they rely on.