The UK GDPR is the UK's data protection framework governing the processing of personal data. It establishes requirements around lawful processing, transparency, consent, data security, accountability and individual data protection rights.

Do I need consent before setting cookies under UK GDPR?

For non-essential cookies and similar tracking technologies, consent is generally required before they are placed or used. Consent should be freely given, specific, informed and unambiguous.

Is an Accept-only cookie banner UK GDPR compliant?

No. Where consent is required, users should be given a genuine choice. Rejecting non-essential cookies should be as easy and clear as accepting them, and non-essential categories should not be pre-selected.

How do I prove consent under UK GDPR?

ConsentX stores tamper-evident consent records containing relevant information about the consent decision, helping organisations maintain an auditable evidence trail.

Does UK GDPR apply to companies outside the UK?

Yes. UK GDPR can apply to organisations outside the UK when they offer goods or services to individuals in the UK or monitor their behaviour.

United Kingdom

UK GDPR compliance with ConsentX

UK General Data Protection Regulation

The UK GDPR is the UK's data protection law, governing how organisations collect, use, store, and protect personal data. It requires organisations to have a lawful basis for processing personal data, provide transparency, respect individual rights, and demonstrate accountability.

Region

United Kingdom

Status

In force since 2021

Group

Europe & UK

Who it applies to

Any organisation established in the UK that processes personal data, as well as organisations outside the UK that offer goods or services to individuals in the UK or monitor their behaviour.

Penalties

Up to £17.5 million or 4% of global annual turnover, whichever is higher, for certain infringements.

Key obligations

Obtain valid consent before using non-essential cookies and trackers where consent is required
Make accepting and refusing consent equally clear and easy
Keep records that demonstrate how and when consent was obtained
Allow individuals to withdraw consent at any time
Respect data subject rights, including access, erasure, rectification and portability
Process personal data lawfully, fairly and transparently