Main Differences between UK GDPR and EU GDPR

Same but different — this is how we can describe the General Data Protection Regulation (GDPR) frameworks of both the United Kingdom and the European Union.  

Despite having several similarities, the two GDPR frameworks still have considerable differences.  

Here's what makes them distinct from each other. 

1. Jurisdiction and Applicability 

UK GDPR applies to: 

-   Entities that operate within the United Kingdom, including England, Scotland, Wales, and Northern Ireland. 
-   Non-UK entities that process the personal data of individuals in the UK must also adhere to the UK GDPR. 

EU GDPR applies to:  

-   Entities that operate within the European Economic Area (EEA). 
-   Non-EU entities that process the personal data of individuals located within the EU must also observe EU GDPR. 

2. Supervisory Authorities 

UK GDPR 

-   Governed solely by the Information Commissioner’s Office (ICO), a public body that upholds information rights and enforces data protection regulations. 
-   Entities that adhere to the UK GDPR must course through their concerns directly to the ICO. 

EU GDPR 

-   Governed by the European Data Protection Board (EDPB), an independent European body composed of each EEA-member country’s head of national data protection authority (Supervisory Authority) and European Data Protection Supervisor (EDPS). 
-   Through EU GDPR’s one-stop-shop mechanism, entities can consult and cooperate directly with their state’s supervisory authority instead of going straight to the EDPB.

3. Penalties and Fines 

UK GDPR 

Standard maximum amount 

-   £8.7 million or 
-   2% of the undertaking’s annual global revenue, whichever is higher. 

Higher maximum amount 

-   £17.5 million or 
-   4% of the undertaking’s annual global revenue, whichever is higher. 

EU GDPR 

For severe violations 

-   Up to €20 million or 
-   Up to 4% of the undertaking’s annual global revenue, whichever is higher. 

For less severe violations 

-   Up to €10 million or 
-   Up to 2% of the undertaking’s annual global revenue, whichever is higher. 

UK GDPR vs EU GDPR: Which one should you follow?  

You need to follow either the UK GDPR or EU GDPR if your organisation only operates and processes personal data of individuals within a single jurisdiction. 

Example:  
If you operate in England and only process personal data of individuals from England, then you only need to follow UK GDPR. 

Meanwhile, you need to follow both the UK GDPR and EU GDPR if your organisation processes personal data of individuals from the UK and the EU member states. 

Example: 
If you operate in England but you also process personal data of individuals from EU member states, then you must also follow the EU GDPR on top of the UK GDPR.

GDPR-compliant accounting outsourcing company 

D&V Philippines is an accounting outsourcing company that complies with both the UK and EU GDPR. To learn more about us, email us at marketing@dvphilippines.com or download our whitepaper, D&V Philippines’ Premium Solutions for UK Accounting Firms.