Last updated: 27 September 2026
UK GDPR is the law that sets out how organisations must handle personal data. The ICO (Information Commissioner’s Office) is the independent UK regulator that enforces that law. In short, GDPR is the rulebook and the ICO is the referee.
What is UK GDPR?
UK GDPR, together with the Data Protection Act 2018, requires organisations to process personal data lawfully, fairly and transparently, keep it secure, collect only what they need, and respect people’s rights, such as the right to access their data. It was updated by the Data (Use and Access) Act 2025, with most changes in force from February 2026.
What does the ICO do?
- Publishes guidance on how to comply
- Handles complaints from the public
- Receives reports of serious personal data breaches (within 72 hours)
- Investigates and can issue fines of up to £17.5 million or 4% of global turnover
- Collects the data protection fee most organisations must pay
From 30 September 2026, the ICO is being replaced by a new body, the Information Commission, which takes over the same regulatory role.
What should my business do?
Make sure you have paid the data protection fee, have an up-to-date privacy notice, keep personal data secure and know how to report a breach. Read how to ensure GDPR compliance and whether UK GDPR is still relevant in 2026.
This article is general guidance, not legal advice.
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.