United Kingdom: data protection and AI governance
UK General Data Protection Regulation + Data (Use and Access) Act 2025 (UK GDPR + DPA 2018 + DUAA 2025), in force since 2018-05-25. Supervisory authority: ICO.
Other languagesFrançaisEspañolالعربية中文
Data protection
- Instrument
- UK General Data Protection Regulation + Data (Use and Access) Act 2025 (UK GDPR + DPA 2018 + DUAA 2025)
- In force since
- 2018-05-25
- Authority
- ICO
- Penalties
- £17.5M ou 4% CA
- Key obligations
- Similaire RGPD
- IDTA transferts
- Adequacy UE
- DUAA 2025 : assouplissements ciblés (intérêts légitimes reconnus, décisions automatisées)
Key obligations and penalties are quoted from the record as the source states them; they are not translated.
What the engine decides here
These three attributes are what an agent decision depends on in this jurisdiction. They are modelled, sourced and dated.
- Transfer regime
- Restricted
Moving data out is restricted: it requires a recognised destination, or an explicit mechanism when the destination is not one.
- Recognised destinations
- EUFRDEITESBENLATPTIEFISEDKPLCZROBGHRHUSKSILTLVEECYMTLUGRNOISLIADARCA_FEDILJPNZKRCHUY
- Localisation mandate
- Not modelled
- Automated decision rights
- Yes
- Verified on
- 2026-08-14
Three decisions, computed just now
Same actions, this jurisdiction's context. These answers come out of the engine as the page renders, from the same function the API calls.
- Allow
Read an internal contract
Low-risk operation
- Approve
Send a customer record to US_FED
The transfer requires a mechanism
- Deny
Decide on a job application
Decision reserved for a human
Advisory decisions. StructureClerk decides; your infrastructure enforces.
AI governance
- Framework
- Pro-innovation approach
- Status
- guidance
- Key points
- Sectoriel
- 5 principes
Do your agents operate in United Kingdom?
The authority API makes these attributes executable: an ALLOW, APPROVE, DENY or ESCALATE decision before the agent acts, with signed evidence any third party can verify.