7 hours ago
If your UK business handles personal data belonging to customers in Ireland, Germany, or the Netherlands, you’re working under two data protection laws at the same time: EU GDPR and UK GDPR. They started out almost identical after Brexit. They are not anymore. The differences now affect your lawful basis, your transfer paperwork, how you handle automated decisions, and which regulator you answer to.
The totals are getting hard to ignore. As of March 2026, the CMS GDPR Enforcement Tracker recorded 2,685 fines, with cumulative fines reaching approximately €6.11 billion. Across 2018–2026, the average fine was around €2.28 million, though that figure is heavily influenced by a small number of very large penalties. Ireland’s Data Protection Commission fined Google €403 million in September 2026 over how it processed location data. In Sweden, the data protection authority fined Miljödata i Karlskrona around €160,000 for insufficient technical and organisational security measures. Regulators are not only targeting the biggest names.
Take a made-up example. A small software company in Manchester has twelve staff and a growing client list across Europe. One Tuesday morning, the operations manager forwards an email. A customer in the Netherlands wants to see every piece of personal data the company holds about them, and expects a response within a month. Nobody on the team has handled a request like this before. If something goes wrong further down the line, which regulator might the business have to answer to?
For a small team without in-house legal support, the challenge is knowing what to do next without having to work through pages of regulation.
By the end of this blog, you’ll understand where EU GDPR and UK GDPR differ and what those differences mean for a UK business.
Source: https://qualysec.com/difference-between-eu-gdpr-and-uk-gdpr/
The totals are getting hard to ignore. As of March 2026, the CMS GDPR Enforcement Tracker recorded 2,685 fines, with cumulative fines reaching approximately €6.11 billion. Across 2018–2026, the average fine was around €2.28 million, though that figure is heavily influenced by a small number of very large penalties. Ireland’s Data Protection Commission fined Google €403 million in September 2026 over how it processed location data. In Sweden, the data protection authority fined Miljödata i Karlskrona around €160,000 for insufficient technical and organisational security measures. Regulators are not only targeting the biggest names.
Take a made-up example. A small software company in Manchester has twelve staff and a growing client list across Europe. One Tuesday morning, the operations manager forwards an email. A customer in the Netherlands wants to see every piece of personal data the company holds about them, and expects a response within a month. Nobody on the team has handled a request like this before. If something goes wrong further down the line, which regulator might the business have to answer to?
For a small team without in-house legal support, the challenge is knowing what to do next without having to work through pages of regulation.
By the end of this blog, you’ll understand where EU GDPR and UK GDPR differ and what those differences mean for a UK business.
Source: https://qualysec.com/difference-between-eu-gdpr-and-uk-gdpr/