The UK's Data (Use and Access) Act 2025 raised the maximum PECR fine 35-fold, from GBP 500,000 to GBP 17.5 million, when the change took effect on 5 February 2026, according to the UK Information Commissioner's Office. That single number captures the pattern running through 2025 and 2026: UK GDPR has stayed structurally close to EU GDPR, but the gap in fine levels, lawful bases, and transfer rules has widened with each DUAA milestone.
How much did the UK's PECR fine cap increase in 2026?
The Privacy and Electronic Communications Regulations, the UK's rulebook for cookies, marketing calls, and email consent, previously capped fines at GBP 500,000 regardless of the violation's scale. From 5 February 2026, that cap rose to GBP 17.5 million or 4% of global annual turnover, whichever is higher, the same higher-tier ceiling UK GDPR already used. The change means a serious cookie-consent or marketing-consent breach can now draw the same order-of-magnitude penalty as a core UK GDPR violation, closing a gap that had existed since PECR was written.
The EU has no equivalent single change to point to. The bloc's ePrivacy rules remain governed by a 2002 directive implemented separately in each member state, so cookie and marketing-consent fine caps still vary by country rather than converging on one EU-wide figure the way the UK's PECR cap just did.
Is the UK's data protection law still adequate under EU GDPR?
Yes, as of December 2025. The UK's original EU adequacy decisions, granted in June 2021, carried a four-year sunset clause due to expire on 27 June 2025. The European Commission extended that window by six months while it assessed the DUAA's impact, then renewed the decisions on 19 December 2025 for a full six years, running to 27 December 2031, with a joint Commission and European Data Protection Board review scheduled after four years.
Figure 1: UK statutory fine ceilings before and after the DUAA took effect. Source: UK Information Commissioner's Office, Clifford Chance (February 2026).
The Commission's own conclusion was that the DUAA represents "subtle refinements rather than a radical overhaul" of UK data protection law, and that UK protections remain essentially equivalent to GDPR. That finding is what keeps EU-to-UK data flows free of extra safeguards for now, but the Commission has flagged that continued divergence could put the next renewal at risk. The UK is one of 172 countries with a national privacy law in 2026, and its adequacy status is what lets it keep trading data freely with the other 26 EU members without a separate legal basis for every transfer.
Figure 2: Key milestones in UK-EU data protection divergence, 2021 to 2031. Source: European Commission, ICO, Clifford Chance.
How do UK GDPR and EU GDPR fines compare in size?
The two regimes are not directly comparable by scale, since one figure is a single year and the other is cumulative since 2018, but the gap is still informative. The ICO issued 15 monetary penalties totaling roughly GBP 21.7 million in 2025, an average of about GBP 1.45 million per fine, up from an average of roughly GBP 150,000 in 2024, according to URM Consulting's analysis of the ICO's published enforcement notices. EU regulators, by contrast, have issued 2,685 recorded fines totaling roughly EUR 6.11 billion cumulative since May 2018, an all-time average of about EUR 2.28 million per fine, per the CMS Enforcement Tracker Report 2026.
| Metric | UK GDPR and DPA (ICO, 2025) | EU GDPR (CMS Enforcement Tracker Report, cutoff Mar 2026) |
|---|---|---|
| Monetary penalties | 15 (2025 only) | 2,685 (cumulative since 2018) |
| Total fine value | Roughly GBP 21.7 million (2025 only) | Roughly EUR 6.11 billion (cumulative) |
| Average fine size | Roughly GBP 1.45 million (2025) | Roughly EUR 2.28 million (all-time average) |
| Largest single fine | GBP 14 million, Capita, October 2025 | EUR 1.2 billion, Meta, May 2023 |
Figure 3: The five largest ICO monetary penalties issued in 2025. Source: UK Information Commissioner's Office, October 2025 announcements.
The ICO's largest 2025 fine, GBP 14 million against Capita over a March 2023 data breach affecting 6.6 million people, was itself reduced from a proposed GBP 45 million after the company demonstrated post-incident improvements and cooperation. That single case accounted for roughly 65% of the year's total UK GDPR and DPA fine value.
Figure 4: Capita's share of the ICO's 2025 GDPR and DPA enforcement total. Source: UK Information Commissioner's Office, URM Consulting analysis.
What are the DUAA's biggest legal divergences from EU GDPR?
Three provisions move UK GDPR meaningfully away from its EU counterpart. First, the DUAA adds a recognised legitimate interest lawful basis for purposes like national security, crime prevention, and safeguarding, letting controllers skip the balancing test EU GDPR still requires under Article 6(1)(f). Second, it narrows the automated decision-making ban in UK GDPR Article 22 so it applies only to special-category data, where EU GDPR keeps a broader default prohibition on decisions with no meaningful human involvement. Third, it exempts statistical, appearance, and emergency-assistance cookies from consent requirements, provided sites still offer a free opt-out, while EU cookie rules under the ePrivacy framework require consent for non-essential cookies generally.
| Topic | EU GDPR | UK GDPR (from Feb 2026) | Diverged since |
|---|---|---|---|
| PECR or cookie fine cap | Set by national ePrivacy law, varies by country | GBP 17.5 million or 4% of turnover, up from GBP 500,000 | 5 February 2026 |
| Automated decision-making | Default ban, Article 22, human review required | Ban narrowed to special-category data only | Phased from June 2025 |
| Cookie consent | Consent required for non-essential cookies | Statistical, appearance, and emergency cookies exempt with opt-out | 5 February 2026 |
| Legitimate interest | Balancing test required, Article 6(1)(f) | Recognised legitimate interest needs no balancing test | Phased from June 2025 |
| Transfer mechanism | EU SCCs, EU-US Data Privacy Framework | UK IDTA, UK Addendum, UK extension to the DPF | Since 1 January 2021 |
| Adequacy sunset | Not applicable to itself | 27 December 2031, six-year renewal | Renewed 19 December 2025 |
How do UK and EU data transfer rules differ now?
If you send personal data outside the UK or EU to a country without an adequacy decision, the transfer mechanism you need depends on which side you are transferring from, not just where the data is going.
Figure 5: Choosing a transfer mechanism depends on which regulator's rules apply. Source: ICO international transfer guidance, gov.uk.
An EU entity sending data to a US processor typically relies on the EU-US Data Privacy Framework or EU SCCs. A UK entity sending data to the same processor needs the UK-specific International Data Transfer Agreement, the UK Addendum to the EU SCCs, or the UK extension to the EU-US DPF, since EU SCCs alone do not satisfy UK GDPR's transfer requirements without that addendum. Businesses operating in both markets end up maintaining two parallel sets of transfer paperwork for what is often the same underlying data flow, one of the more operationally expensive consequences of the divergence since 1 January 2021.
A privacy policy that only names EU SCCs, or that describes transfer safeguards in EU-only terms, is a common gap for UK-facing sites. If your business collects data from users in the UK, generate a privacy policy that names the correct UK transfer mechanism alongside any EU-facing SCC language, rather than assuming EU wording covers both regimes. The three-way split is not unique to the UK and EU either: Canada's PIPEDA runs a separate enforcement regime again, with no administrative fine power at all until proposed reforms pass, so a site handling UK, EU, and Canadian users needs three distinct compliance postures, not one.
The Bottom Line
UK GDPR and EU GDPR are still close enough that the European Commission renewed the UK's adequacy decisions through 2031 rather than letting them lapse. But the practical distance between the two regimes has grown since the DUAA began landing in 2025: a 35x jump in the UK's cookie and marketing-consent fine cap, a narrower automated-decision-making ban, a new legitimate-interest basis with no balancing test, and a transfer-mechanism set that no longer overlaps cleanly with EU SCCs. None of that is optional detail for a site serving both UK and EU users. If your privacy policy or cookie banner was last updated before 2025, it is likely written to a single "GDPR" standard that no longer describes either regime precisely.
Frequently Asked Questions
Is the UK still considered adequate under EU GDPR in 2026? Yes. The European Commission renewed the UK's data adequacy decisions on 19 December 2025, after a six-month interim extension while it reviewed the Data (Use and Access) Act 2025. The renewed decisions run for six years, until 27 December 2031, with a joint Commission and European Data Protection Board review scheduled after four years.
What is the biggest change the Data (Use and Access) Act made to UK GDPR? The most measurable change is the PECR fine cap, which rose 35-fold from GBP 500,000 to GBP 17.5 million or 4% of global turnover on 5 February 2026, matching UK GDPR's own higher-tier cap. The DUAA also narrowed the ban on fully automated decisions to special-category data only and added a recognised legitimate interest lawful basis with no balancing test required.
Are UK GDPR and EU GDPR fines similar in size? Not directly comparable by scale, but the direction is telling. UK regulator the ICO issued 15 monetary penalties totaling roughly GBP 21.7 million in 2025, an average of about GBP 1.45 million per fine. EU regulators have issued 2,685 fines totaling roughly EUR 6.11 billion cumulative since 2018, an all-time average of about EUR 2.28 million per fine, per the CMS Enforcement Tracker Report 2026.
Do businesses need separate data transfer mechanisms for the UK and EU? Yes. An EU entity sending data to a non-adequate country typically relies on EU Standard Contractual Clauses or the EU-US Data Privacy Framework, while a UK entity uses the UK's own International Data Transfer Agreement, the UK Addendum to the EU SCCs, or the UK extension to the EU-US DPF. The two sets of clauses are not interchangeable without the correct addendum.
Where the Numbers Come From
- UK Information Commissioner's Office. (2025). "Capita fined GBP14m for data breach affecting over 6m people." 15 October 2025, fine reduced from a proposed GBP45 million.
- Clifford Chance. (2026). "Key aspects of the Data (Use and Access) Act take effect." PECR fine cap raised to GBP17.5 million, effective 5 February 2026.
- European Commission. (2025). "Renewal of the UK adequacy decision under the GDPR." Adopted 19 December 2025, valid until 27 December 2031.
- Arnold and Porter. (2025). "European Commission Indicates That the UK Remains Adequate Following the Introduction of the Data (Use and Access) Act 2025." July 2025.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 fines, EUR6.11 billion cumulative, cutoff 1 March 2026.
- URM Consulting. (2026). "Analysis of Enforcement Action by the ICO in 2025." Analysis of the ICO's published enforcement notices, 15 monetary penalties, average fine roughly GBP1.45 million.
- Womble Bond Dickinson. (2025). "Understanding the Data (Use and Access) Act: what businesses need to know." Royal assent 19 June 2025, implementation timeline through June 2026.
Note: All figures verified as of February 2026. The DUAA's rollout continued through June 2026, and the UK's next adequacy review is expected roughly four years after the 19 December 2025 renewal. Figures are refreshed at least twice a year to track new ICO enforcement notices and CMS Enforcement Tracker Report editions.
