UK GDPR After Brexit: What Changed
The UK's Data Protection and Digital Information (DPDI) Act 2025 makes 14 changes to EU GDPR rules. These create the first real split between EU and UK privacy law since Brexit. The EU-UK adequacy deal is under review. Its outcome matters for every business that moves personal data between the two regions.
The LastPass Fine: A New Technical Bar
The ICO fined LastPass UK £1.2 million in December 2025. This is the UK's biggest technical security case to date.
The ICO found two core failures.
Weak encryption: LastPass stored customer password vaults with old encryption. The ICO called it "inadequate" under UK GDPR Article 32. Some vaults used PBKDF2-SHA256 with only one iteration. The UK NCSC says password keys need at least 600,000 iterations.
What the law now requires: UK GDPR Article 32 demands "appropriate technical measures" that match the "state of the art." The ICO found that key derivation in 2022 needed far more than LastPass gave. What was fine in 2015 was not fine in 2022.
The result: vendor encryption is now an auditable item. You must check that your tools use current parameters — not old baselines. See our security and compliance overview for how we handle this.
DPDI Act 2025: Six Key Changes
The Act makes 14 identified changes to UK data law. Six have direct day-to-day impact.
1. Legitimate interests. The Act lists "recognized legitimate interests." These skip the balancing test that EU law still requires. This makes the basis easier to use for UK businesses.
2. Research and statistics. The Act widens the research exemption. Secondary use of personal data for research needs fewer consents than EU law requires.
3. Automated decisions. The Act replaces EU Article 22. The new rule is more relaxed. Some automated decisions no longer need meaningful human review.
4. Record-keeping. The Act drops the mandatory records of processing (ROPA) for firms under 250 staff with no "systematic" processing. EU rules require ROPA for all firms whose processing is not occasional.
5. Cookie consent. The Act cuts consent rules for analytics cookies. It backs "cookie-less" options. EU ePrivacy rules still require consent for tracking cookies.
6. International transfers. The UK Secretary of State gets wider power to grant adequacy decisions. The UK may approve countries the EU has not. This splits the transfer framework on both sides.
The Adequacy Risk
The European Commission will check whether UK law gives "essentially equivalent" protection to EU rules.
Three areas worry EU monitors.
The DPDI Act's wider legitimate interests may leave gaps the Commission calls inadequate. The UK Investigatory Powers Act 2016 still raises concerns tied to CJEU case law. UK-US deals under the CLOUD Act may expose EU data to US law enforcement.
If adequacy is suspended, over 10,000 UK-EU Standard Contractual Clause sets would need fast activation. Firms relying only on adequacy for UK-EU transfers would face gaps overnight. Check our compliance guide to review your exposure.
Running Both Regimes at Once
For firms under both EU and UK law, the path is clear.
Use the stricter baseline. EU Article 32, the EU legitimate interests test, and EU automated decision rules are all stricter than their UK Act equivalents. Meeting EU rules means meeting UK rules, plus a few UK extras.
Document both legal bases. For legitimate interests, write down both the EU balancing test result and proof that the processing fits a UK recognized category. Dual records protect you if rules diverge further.
Keep SCCs ready. The 2026 adequacy review will decide whether you need separate transfer tools. Keep Standard Contractual Clauses live as a backup even while using adequacy.
Check vendor encryption. The LastPass case makes vendor encryption a live compliance item. Confirm tools handling personal data use current settings: AES-256-GCM at rest, argon2id or PBKDF2 with current iteration counts for key derivation. Browse our FAQ for common audit questions.
The UK split is the first real break in the EU privacy model. For firms in both regions, the safest move is to design for the harder standard — which is still the EU framework.
anonym.legal processes documents in EU-based Hetzner data centers with zero-knowledge design. The server never sees your plain-text. A full server breach yields only AES-256-GCM ciphertext. Need local processing? The Desktop App runs on your device with no external connections.
Sources
- ICO: Information Commissioner's Office — VERIFIED-EXTERNAL
- ICO: Enforcement Actions — VERIFIED-EXTERNAL
- UK Government: DPDI Act 2025 Analysis — VERIFIED-EXTERNAL