The UK kept the GDPR after Brexit and has since started to diverge from it. The Data (Use and Access) Act 2025 relaxed some rules, such as recognised legitimate interests and automated decision-making, while raising fines for cookie and marketing breaches. At the same time, the Online Safety Act has made the UK one of the strictest places in the world to run a user-generated content or social product.
There is no UK AI Act. Instead, regulators such as the ICO, CMA, FCA and Ofcom apply their existing powers to AI. For most startups, UK compliance means a UK-tuned privacy programme, a PECR-compliant cookie and marketing set-up, and, for platforms, an Online Safety Act workstream.
- Core data law
- UK GDPR, Data Protection Act 2018, DUAA 2025
- Regulator
- ICO (moving to an Information Commission)
- Cookies & marketing
- PECR, fines now aligned with UK GDPR
- Online safety
- Online Safety Act 2023 (Ofcom)
- AI law
- No horizontal law; regulator-led
- Pending
- Cyber Security and Resilience Bill
Who needs to comply
Any startup with UK users or customers
UK GDPR applies to processing by UK establishments and to non-UK companies offering goods or services to, or monitoring, people in the UK.
Websites and apps using cookies, analytics or email marketing
PECR requires consent for non-essential cookies and for most electronic marketing to individuals.
Social, UGC, messaging, gaming, dating and search services
The Online Safety Act applies to user-to-user and search services with links to the UK, wherever they are based.
Services likely to be used by children
The ICO’s Age Appropriate Design Code (Children’s Code) and the OSA’s child safety duties both apply.
Makers of connected consumer devices
The Product Security and Telecommunications Infrastructure (PSTI) regime sets minimum security requirements, such as banning default passwords.
Fintech and AI in regulated sectors
FCA rules, consumer duty and operational resilience apply alongside data protection.
The laws, in detail
01UK GDPR, Data Protection Act 2018 & Data (Use and Access) Act 2025
Personal data processing, rights, security, transfers and automated decision-making.
When it applies
UK establishment, or offering goods/services to or monitoring people in the UK.
What you must do
- Lawful basis, including new recognised legitimate interests
- Privacy notices, records and DPIAs
- Safeguards for significant automated decisions: information, representations, human intervention
- Breach notification to the ICO within 72 hours
- Data protection complaints procedure (from June 2026)
- UK transfer tools: adequacy, IDTA or UK addendum to EU SCCs
- UK representative if not established in the UK
Regulator
Information Commissioner’s Office (ICO)
Penalties
Up to £17.5 million or 4% of worldwide turnover.
02Privacy and Electronic Communications Regulations (PECR)
Cookies and similar technologies, and electronic direct marketing.
When it applies
Using cookies or tracking on UK users’ devices, or sending marketing emails, texts or calls in the UK.
What you must do
- Consent for non-essential cookies (with DUAA exceptions for some analytics)
- Opt-in for marketing to individuals; soft opt-in for existing customers
- Easy unsubscribe in every message
Regulator
ICO
Penalties
Aligned with UK GDPR levels under the DUAA.
03Online Safety Act 2023
Illegal content and child safety duties for online services.
When it applies
User-to-user and search services with a significant number of UK users or targeting the UK.
What you must do
- Illegal content risk assessment and safety measures
- Children’s access assessment; children’s risk assessment if likely to be accessed
- Highly effective age assurance for pornography and certain harmful content
- Reporting and complaints tools; clear terms of service
Regulator
Ofcom
Penalties
Up to £18 million or 10% of qualifying worldwide revenue, and business disruption measures.
04Age Appropriate Design Code (Children’s Code)
Fifteen standards for online services likely to be accessed by under-18s.
When it applies
Information society services likely to be accessed by children in the UK.
What you must do
- High privacy settings by default
- Data minimisation and no nudging towards weaker privacy
- Geolocation and profiling off by default
- Age-appropriate transparency
Regulator
ICO
Penalties
Enforced through UK GDPR.
05Product Security and Telecommunications Infrastructure (PSTI) regime
Minimum security requirements for consumer connectable products.
When it applies
Manufacturers, importers and distributors of connectable consumer products in the UK.
What you must do
- No universal default passwords
- A published way to report vulnerabilities
- Stated minimum security update period
Regulator
Office for Product Safety and Standards
Penalties
Fines up to £10 million or 4% of worldwide revenue.
06AI: regulator-led approach
AI is regulated through existing laws and regulators applying cross-sector principles.
When it applies
Any AI used in the UK, through data, consumer, competition, equality and sector law.
What you must do
- ICO guidance on AI and data protection, including fairness and explainability
- Consumer law on misleading AI claims (CMA)
- Equality Act in automated decisions about people
Regulator
ICO, CMA, FCA, Ofcom, EHRC
Penalties
Under each underlying law.
Compliance checklist
01 · Before you launch in the UK
- Adapt your EU GDPR programme for UK GDPR and DUAA differences
- Appoint a UK representative if you have no UK establishment
- Put UK transfer tools in place (IDTA or UK addendum)
- Set up PECR-compliant cookie consent and marketing opt-ins
- Run the Online Safety Act applicability and children’s access assessments
02 · At launch
- Publish a data protection complaints procedure
- ADM safeguards for significant automated decisions
- Children’s Code defaults if children are likely to use the service
- Vulnerability reporting route for connected products
03 · As you scale
- Pay the ICO data protection fee
- Track Ofcom codes and categorisation thresholds
- Monitor the Cyber Security and Resilience Bill if you provide MSP or data centre services
- Sector rules (FCA consumer duty, operational resilience)
Key dates
- 29 Apr 2024PSTI product security regime in force
- Mar 2025OSA illegal harms duties enforceable
- 25 Jul 2025OSA child safety duties and age checks
- Feb 2026Main DUAA data protection reforms commence
- 19 Jun 2026Complaints procedure duty
- PendingCyber Security and Resilience Bill in Parliament
Common mistakes
- Assuming EU and UK rules stay identical; ADM, cookies and transfers now differ.
- Forgetting the ICO data protection fee.
- Treating the OSA as a ‘big platform’ law; small services with UK users are in scope.
- No age assurance plan when children could use the product.
FAQs
Does the Online Safety Act apply to a small startup outside the UK?
It can. It applies to user-to-user and search services with links to the UK, including a significant number of UK users, regardless of size.
Do EU SCCs work for UK transfers?
Only with the UK addendum, or you can use the UK’s International Data Transfer Agreement.
Will the UK pass an AI Act?
There is no horizontal AI law as of October 2026. Expect regulator guidance and targeted legislation instead.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.