The UK GDPR is the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (EU GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).

It is defined in section 3(10) of the Data Protection Act 2018 (DPA 2018), supplemented by section 205(4).

It includes the provisions of what was previously the applied GDPR, unless the context otherwise requires.

With effect from 1 January 2021, organisations need to bear in mind that there are two legal texts to consider, where relevant: the UK GDPR as well as the DPA 2018.

For further information, see Practice notes, Brexit: implications for data protection and Brexit post-transition period: data protection (UK).