United Kingdom — data protection and AI governance
UK General Data Protection Regulation + Data (Use and Access) Act 2025 (UK GDPR + DPA 2018 + DUAA 2025), in force since 2018-05-25. Supervisory authority: ICO.
Data protection
- Instrument
- UK General Data Protection Regulation + Data (Use and Access) Act 2025 (UK GDPR + DPA 2018 + DUAA 2025)
- In force since
- 2018-05-25
- Authority
- ICO
- Penalties
- £17.5M ou 4% CA
- Key obligations
- Similaire RGPD
- IDTA transferts
- Adequacy UE
- DUAA 2025 : assouplissements ciblés (intérêts légitimes reconnus, décisions automatisées)
What the engine decides here
These three attributes are what an agent decision depends on in this jurisdiction. They are modelled, sourced and dated.
- Transfer regime
- Restricted
Moving data out is restricted: it requires a recognised destination, or an explicit mechanism when the destination is not one.
- Recognised destinations
- EUFRDEITESBENLATPTIEFISEDKPLCZROBGHRHUSKSILTLVEECYMTLUGRNOISLIADARCA_FEDILJPNZKRCHUY
- Localisation mandate
- Not modelled
- Automated decision rights
- Yes
- Verified on
- 2026-08-14
Three decisions, computed just now
Same actions, this jurisdiction's context. These answers come out of the engine as the page renders — the same function the API calls.
- ALLOW
Read an internal contract
Low-risk operation
- APPROVE
Send a customer record to US_FED
The transfer requires a mechanism
- DENY
Decide on a job application
Decision reserved for a human
Advisory decisions. StructureClerk decides; your infrastructure enforces.
AI governance
- Framework
- Pro-innovation approach
- Status
- guidance
- Key points
- Sectoriel
- 5 principes
Do your agents operate in United Kingdom?
The authority API makes these attributes executable: an ALLOW, APPROVE, DENY or ESCALATE decision before the agent acts, with signed evidence any third party can verify.