The Data (Use and Access) Act 2025 changed UK GDPR and, although the EU-to-UK flows are secure until the end of 2031 and most of Article 28 terms and breach windows still line up, the changes are now reflected in the contracts: what counts as a lawful basis, how far a subject access search has to go, and the test for sending personal data out of the UK.
If your company operates on both sides of the Channel, your DPA and data sharing templates must be revised - they mostly still work, but some are certainly out of date and now describe the wrong law for one side of the deal.
In order to fix that and ensure you comply with the new UK GDPR rules, you can follow this compliance checklist. It goes through the divergence clause by clause, comparing both GDPR sections side by side and providing a listing of what to include and check for in the contract. Better yet, Book a LEGALFLY demo and see how we build a personalised playbook for you, based on your internal guidelines or golden contracts, that complies with old and new GDPR rules.
The good: EU-to-UK data flows are secure until 2031
On December 19th, 2025, the European Commission renewed its two UK adequacy decisions, one under the GDPR and one under the Law Enforcement Directive. Both run until 27 December 2031, with a review by the Commission and the EDPB after four years.
The renewal came after the Commission assessed the Data (Use and Access) Act 2025 and concluded that UK protection remains essentially equivalent to the EU's. That means:
EU entities can keep sending personal data to UK group companies, processors and customers without SCCs or a transfer impact assessment.
Existing EU-to-UK flows in your DPAs need no new transfer mechanism.
UK-to-EU flows are covered by the UK's own adequacy regulations for the EEA.
The divergence hits two spots, neither of them the cross-Channel link: transfers out of the UK to the rest of the world, and dual-regime templates that assume one rulebook for both sides.
The changes: the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent on June 19th, 2025. It amends the UK GDPR, the Data Protection Act 2018 and PECR, with the bulk of the data protection changes being implemented on February 5th, 2026 under the sixth commencement regulations (SI 2026/82).
None of these changes apply to EU GDPR, therefore, a company that processes the same customer database in London and Amsterdam must now run it under two different legal texts, its contracts specifying which one applies to which flow.
A side-by-side Checklist
To fully take advantage of the following checklist, sort your templates and live contracts into three groups beforehand - UK-only Contracts, EU-only contracts and Dual-regime contracts (this one being both the most common in cross-Channel groups and the one carrying most of the risk).
For each of the following 5 areas, the checklist sets out the UK position, the EU position, and the contract check. A dual-regime template is valid when each clause either works under both laws or clearly points to the regime that governs each flow.
1. Lawful basis language in contracts
UK GDPR now has a seventh lawful basis. Under Article 6(1)(ea), processing that is necessary for a "recognised legitimate interest" listed in Annex 1 is now allowed without the previously balancing test required.
Separately, Article 6(11) names direct marketing, intra-group transmission and network and information security as purposes capable of being legitimate interests, but that still need the balancing test.
Lastly, under Article 22B, a solely automated significant decision cannot rest on the recognised legitimate interests basis at all.
Point | UK GDPR (since 5 February 2026) | EU GDPR |
Lawful bases | Seven, including recognised legitimate interests | Six |
Balancing test for crime prevention, safeguarding, emergencies | Not required under Annex 1 | Required under Art. 6(1)(f) |
Intra-group sharing, direct marketing, network security | Named in statute as capable of being legitimate interests; balancing test still applies | Mentioned in recitals 47 to 49; balancing test applies |
Further processing | Art. 8A factors, plus Annex 2 list of compatible purposes | Art. 6(4) compatibility test |
Checklist: Lawful Basis Clauses
☑️ Data sharing and controller-to-controller agreements that list lawful bases by article number refer to the correct text for each regime. A clause citing "Article 6(1)(f)" for fraud-prevention sharing may now sit more naturally under Article 6(1)(ea) on the UK side only.
☑️ Intra-group data transfer agreements do not assume the UK statutory recognition of intra-group sharing applies to EU entities.
☑️ Warranties that "the controller has a lawful basis under Article 6 of the GDPR" are drafted to cover "the UK GDPR or the EU GDPR, as applicable".
☑️ Clauses on disclosures to regulators, police or public bodies distinguish the UK Annex 1 route from the EU position.
☑️ Where a counterparty uses automated decision-making, the contract does not let it rely on recognised legitimate interests for those decisions.
☑️ Compatible further processing is not expanded for EU flows because the UK Annex 2 list allows it.
Be aware that most dual-regime templates define "Data Protection Laws" as "the GDPR and the UK GDPR", and then cite single article numbers as if the texts were identical, which no longer are since 2021.
2. DSAR cooperation clauses
Both regimes apply different rules to subject access:
Article 15(1A) in the UK GDPR limits the controller's duty to what a reasonable and proportionate search produces.
Article 12A also sets the time limit to one month from the "relevant time", aka, the latest between receipt of the request, any identity information requested, or any fee. The clock pauses while the controller waits for the clarification it reasonably needs, and can be extended by two months for complex or multiple requests.
From June 19th, 2026, UK controllers must also run a complaints procedure. Individuals can now complain directly to the controller, which must acknowledge within 30 days and respond without undue delay.
Point | UK GDPR | EU GDPR |
Scope of search | Reasonable and proportionate search, in statute | No statutory limit; EDPB guidance on proportionality only in narrow cases |
Time limit | One month from the relevant time; stop-the-clock for clarification | One month from receipt; extension of two months |
Complaints to the controller | Statutory duty since 19 June 2026, 30-day acknowledgement | No equivalent duty |
Checklist: DSAR and Complaints clauses
☑️ The processor's deadline to assist with a request is set in days from your notice, not tied to "the statutory deadline", so it works under both clocks.
☑️ The processor must search its systems and sub-processors to the standard you set. For UK requests, that standard is reasonable and proportionate; for EU requests the contract should not assume the same limit.
☑️ The processor must record the scope of its search, so you can show it was reasonable and proportionate if the regulator asks.
☑️ The processor forwards requests it receives directly within a short fixed period, typically two to five working days, so the UK stop-the-clock or EU deadline is not lost.
☑️ The processor assists with UK complaints, including providing information within the 30-day acknowledgement window.
☑️ Cost allocation for manifestly unfounded or excessive requests follows the regime that applies.
Be aware that “The Processor shall assist the Controller within the timescales required by Data Protection Laws" sounds safe until you consider two different clocks and two different search standards, in which case, it hands the interpretation to the processor.
3. Transfer mechanisms: UK IDTA and UK Addendum versus EU SCCs
Transfers out of the UK and transfers out of the EU now run on separate toolkits.
An EU Exporter follows the 2021 EU standard contractual clauses, while a UK Exporter has two sets of standard data protection clauses to guide them, the International Data Transfer Agreement (IDTA), a standalone UK contract, and the UK Addendum, which bolts onto the EU SCCs, so one document can cover both regimes.
Point | UK exports | EU exports |
Standard clauses | IDTA, or UK Addendum to the EU SCCs | 2021 EU SCCs (four modules) |
Adequacy decided by | Secretary of State, by regulations | European Commission |
US transfers | UK Extension to the EU-US Data Privacy Framework | EU-US Data Privacy Framework |
Risk assessment | Transfer risk assessment, now the statutory "data protection test" | Transfer impact assessment under the EDPB Recommendations 01/2020 |
Clause updates | IDTA and Addendum updates expected in 2026 | No change pending to the 2021 SCCs for standard cases |
Checklist: Transfer Clauses
☑️ Every UK restricted transfer is covered by UK adequacy regulations, the IDTA, the UK Addendum, UK binding corporate rules or a derogation. EU SCCs alone do not cover a UK export.
☑️ Dual-regime contracts that use EU SCCs attach the UK Addendum, with its tables completed rather than left blank.
☑️ The ICO's three-step test from its January 2026 guidance has been used to confirm which flows are restricted transfers, including which party initiates the transfer.
☑️ The auto-update option in the IDTA or Addendum has been considered, so the 2026 revision does not require a new signature round.
☑️ US transfers relying on the UK Extension to the DPF are backed by the IDTA or Addendum as a fallback, in case the DPF falls on the EU side and takes the UK Extension with it.
☑️ Onward transfer clauses address both regimes, because an importer may receive the same data under EU SCCs and the UK Addendum.
Be aware that older dual-regime DPAs still attach EU SCCs with a one-line statement that "apply mutatis mutandis to UK transfers", which was never a valid UK mechanism.
4. Transfer risk assessments under the new UK test
The most significant legal divergence for contracts. EU law still asks whether protection in the destination country is "essentially equivalent" to EU protection, the standard set by the Court of Justice in Schrems II. Now, UK law also asks whether the standard of protection is "not materially lower" than under UK GDPR.
Under Article 46(1A), a UK exporter relying on the IDTA, the Addendum or another safeguard, must, within reason and proportion, consider whether that test is met. This is the "data protection test" under UK legislation (or transfer risk assessment (TRA) for the ICO). In practice, a transfer that passes the EU test will usually pass the UK test, but the reverse is not guaranteed. A group that runs one assessment for both regimes should write it to the stricter EU standard, or run parallel UK and EU assessments.
Point | UK transfer risk assessment | EU transfer impact assessment |
Legal standard | Not materially lower than UK GDPR | Essentially equivalent to EU law |
Approach | Reasonable and proportionate, risk-based | Six-step EDPB method, focus on public authority access |
Statutory basis | Art. 46(1A) UK GDPR | Art. 46 GDPR as read in Schrems II |
Guidance | ICO TRA guidance, updated 15 January 2026; more expected in 2026 | EDPB Recommendations 01/2020 |
Checklist: Risk Assessment Clauses
☑️ The importer must provide the information you need to complete both a UK TRA and an EU TIA, including on local law and government access.
☑️ Each assessment is documented separately or, if combined, meets the EU standard.
☑️ Supplementary measures identified in either assessment are written into the security annex.
☑️ The importer must notify you of changes in local law or practice that could affect either assessment.
☑️ Review dates are set for both assessments, and tied to changes in processing location or sub-processors.
☑️ Contracts do not describe the UK test as "essentially equivalent". It is a common drafting error in pre-2026 templates.
5. UK and EU representative requirements
The UK kept the representative rule after Brexit. Article 27of the UK GDPR requires that a controller or processor outside the UK caught by Article 3(2) (aka, offering goods or services to people in the UK, or monitoring their behaviour there) to appoint a UK representative. The EU rule mirrors it, down to the same Article 27 under EU GDPR: a UK company targeting EU individuals without an EU establishment needs an EU representative.
For a cross-Channel group, the representative depends on how the group is structured. A UK subsidiary is an establishment for UK purposes, and an EU subsidiary is an establishment for EU purposes, so the rule mostly catches standalone entities: a UK company selling into the EU directly, or an EU or US company selling into the UK directly.
Point | UK GDPR | EU GDPR |
Who needs one | Non-UK controllers and processors caught by Art. 3(2) UK GDPR | Non-EU controllers and processors caught by Art. 3(2) EU GDPR, including UK companies |
Exception | Occasional processing, no large-scale special category or criminal data, unlikely to create a risk | Same |
Where | In the UK | In a member state where data subjects are |
Checklist: Representatives
☑️ Each entity has assessed whether Article 3(2) applies to it under each regime, separately.
☑️ UK companies selling directly into the EU have appointed an EU representative, and EU or US companies selling directly into the UK have appointed a UK representative.
☑️ The representative is named in the privacy notice for each regime.
☑️ DPAs and data sharing agreements identify each party's representative, where one is required.
☑️ Representative mandates allow access to the records of processing, and cover cooperation with both the ICO and EU supervisory authorities as relevant.
Be aware that many groups appointed an EU representative for their UK entities in 2021 and never reviewed it, so it might no longer match the entities that actually target EU individuals.
6. Other divergence worth checking
The five areas above carry most of the contract work, but there are still some changes that apply to specific clauses or counterparties:
1. Automated decision-making - Article 22 UK GDPR was replaced by Articles 22A to 22D.
Solely automated significant decisions are now generally allowed with four safeguards: information, a way to make representations, human intervention and a right to contest.
Tighter rules apply to special category data. EU Article 22 still starts from a prohibition with exceptions. AI vendor contracts covering both regimes need to support the stricter EU position.
2. Cookies and PECR - UK PECR now lists consent exemptions, including analytics for improving a service where users get clear information and a simple way to object.
PECR breaches now carry UK GDPR-level fines of up to £17.5 million or 4% of worldwide turnover.
EU cookie rules still sit in the ePrivacy Directive and national law. Marketing and analytics vendor contracts should not apply the UK exemptions to EU sites.
3. Complaints - Since June 19th 2026, UK controllers must handle complaints from individuals directly, with a 30-day acknowledgement.
Processor assistance clauses should cover it.
4. The regulator - The Act restructures the ICO into an Information Commission with a board and stronger investigation powers.
Contracts that name "the Information Commissioner" should refer to the UK supervisory authority generally, so a name change does not matter.
5. What has not changed - Breach notification to the regulator stays at 72 hours in both regimes.
Article 28 processor terms are still aligned, so the core of a DPA can stay common.
The EU side is moving too. The European Commission's Digital Omnibus proposal would change parts of EU GDPR, including breach notification and the definition of personal data. It is still a proposal and has not yet reached trilogue. When it lands, some UK and EU positions may move closer and others further apart.
Dual-Regime templates that do not assume one rulebook
The goal is one template with divergences handled clause by clause.
That requires four drafting moves steps:
Define the regimes separately - Replace a single definition of "Data Protection Laws" with "EU Data Protection Law" and "UK Data Protection Law", each including amendments and replacements from time to time. Then, state which applies to which processing.
Avoid article numbers where the texts differ - Refer to the lawful basis, the right of access or the transfer safeguard by description, "as applicable under the relevant Data Protection Law", rather than citing Article 6(1)(f) or Article 22, as they are not common.
Set operational deadlines in days - Processor deadlines for DSAR assistance, breach notice and complaints should be fixed periods from your notice, so they work under both clocks.
Run transfers as a pack - Attach the EU SCCs with the UK Addendum, or the EU SCCs plus the IDTA, and require separate or EU-standard risk assessments. Opt into automatic updates of the UK clauses whenever possible.
Run two rulebooks safely with LEGALFLY
LEGALFLY, the legal operating system for in-house teams, keeps each contract checked against the right regime.
MSIG Europe, a property, casualty, and marine insurer operating across several European countries, implemented LEGALFLY's contract review and playbook functionality, to help review their evergrowing data protection agreements. Since deployment, the time spent reviewing, tracking or responding to business questions decreased dramatically - in some cases, from a full day to around 20 minutes - while consistency and quality maintained, allowing the teams to expand jurisdictional coverage.
All of it due to LEGALFLY’s extended solutions:
Agent Studio
With Agent Studio, Legal can build a single review workflow, from the moment a DPA, data sharing agreement or vendor contract arrives until the department makes a decision. LEGALFLY reads the contract's governing law and party roles, and selects the matching playbook between the UK GDPR, EU GDPR or a dual-regime. A Review agent will then check the contract against this selected playbook, and pass the terms that match it or escalate the deviations to Legal, each clearly flagged and accompanied by a suggested redraft.
LEGALFLY Playbooks are uniquely suited for these tasks since they automatically apply different rules per jurisdiction and based on governing law. In other words, a UK-law contract is never accidentally checked against EU-only rulings.
To find out how LEGALFLY could work for you, schedule a call with one of our experts.
Anonymisation
DPAs and data sharing agreements are full of names, contact details and signatories, which LEGALFLY anonymises at import, before any analysis begins.
That is why this is the only legal AI that anonymises documents before analysis, so personally identifiable data never leaves your environment.
To find out how LEGALFLY could work for you, schedule a call with one of our experts.
Contract Intelligence
The hardest question after a legal change is understanding which contracts it applies to.
LEGALFLY’s new feature, Contract Intelligence, solves this issue by providing full visibility across the contract lifecycle, from negotiation through approval and e-signature to obligations, renewals and key dates.
To find out how LEGALFLY could work for you, schedule a call with one of our experts.
Legal Radar
The ICO's transfer guidance, the IDTA update and the EU's Digital Omnibus are all still moving, and don’t always apply to your contracts.
Legal Radar monitors regulators and official publishers across 130+ jurisdictions, summarises each change in plain English, and tests its impact against your own contracts and policies, providing you with a list of what actually changed instead of a notification that something did.
To find out how LEGALFLY could work for you, schedule a call with one of our experts.
FAQs About UK GDPR Compliance Checklist
What is the difference between UK GDPR and EU GDPR in 2026?
Since the Data (Use and Access) Act changes came into force on February 5th 2026, UK GDPR has a new recognised legitimate interests basis, statutory limits and timing rules for subject access requests, a safeguards-based regime for automated decisions, and a transfer test of "not materially lower" instead of "essentially equivalent". EU GDPR has not changed.
Can we still transfer personal data from the EU to the UK?
Yes. The European Commission renewed the UK adequacy decisions on December 19th 2025, valid until December 27th 2031. No SCCs or transfer impact assessment are needed for EU-to-UK flows.
Do we need the IDTA or the UK Addendum?
For restricted transfers from the UK to countries without UK adequacy regulations, yes, unless you rely on UK binding corporate rules or a derogation. The UK Addendum is usually the easier choice for groups that already use EU SCCs.
Will the IDTA and UK Addendum change?
The ICO plans to update both during 2026 to reflect the Data (Use and Access) Act. It says organisations should keep using the current versions until then.
Is a transfer risk assessment still required under UK GDPR?
Yes. UK law now calls it the "data protection test". Whether you rely on the IDTA, the Addendum or another safeguard, you must consider, within reason and proportion, if protection in the destination is materially lower, or not, than under UK GDPR.
What should a UK GDPR compliance checklist for contracts cover?
Lawful basis wording, DSAR and complaints cooperation, transfer mechanisms, transfer risk assessments and representatives, plus automated decision-making and cookie terms where relevant.
