Same but different — this is how we can describe the General Data Protection Regulation (GDPR) frameworks of both the United Kingdom and the European Union.
Despite having several similarities, the two GDPR frameworks still have considerable differences.
Here's what makes them distinct from each other.
- Entities that operate within the United Kingdom, including England, Scotland, Wales, and Northern Ireland.
- Non-UK entities that process the personal data of individuals in the UK must also adhere to the UK GDPR.
- Entities that operate within the European Economic Area (EEA).
- Non-EU entities that process the personal data of individuals located within the EU must also observe EU GDPR.
- Governed solely by the Information Commissioner’s Office (ICO), a public body that upholds information rights and enforces data protection regulations.
- Entities that adhere to the UK GDPR must course through their concerns directly to the ICO.
- Governed by the European Data Protection Board (EDPB), an independent European body composed of each EEA-member country’s head of national data protection authority (Supervisory Authority) and European Data Protection Supervisor (EDPS).
- Through EU GDPR’s one-stop-shop mechanism, entities can consult and cooperate directly with their state’s supervisory authority instead of going straight to the EDPB.
- £8.7 million or
- 2% of the undertaking’s annual global revenue, whichever is higher.
- £17.5 million or
- 4% of the undertaking’s annual global revenue, whichever is higher.
- Up to €20 million or
- Up to 4% of the undertaking’s annual global revenue, whichever is higher.
- Up to €10 million or
- Up to 2% of the undertaking’s annual global revenue, whichever is higher.
You need to follow either the UK GDPR or EU GDPR if your organisation only operates and processes personal data of individuals within a single jurisdiction.
Example:
If you operate in England and only process personal data of individuals from England, then you only need to follow UK GDPR.
Meanwhile, you need to follow both the UK GDPR and EU GDPR if your organisation processes personal data of individuals from the UK and the EU member states.
Example:
If you operate in England but you also process personal data of individuals from EU member states, then you must also follow the EU GDPR on top of the UK GDPR.
D&V Philippines is an accounting outsourcing company that complies with both the UK and EU GDPR. To learn more about us, email us at marketing@dvphilippines.com or download our whitepaper, D&V Philippines’ Premium Solutions for UK Accounting Firms.