One of the things I still see often in contracts, privacy notices and policies is wording that treats UK and EU data protection law as though it is basically the same thing.
It isn’t.
The two regimes are still closely related, of course, but they have been moving apart for some time. The UK now has its own legislation, regulatory guidance, adequacy decisions and transfer tools. The EU also has its own regulatory framework and, importantly, member state laws which can add another layer altogether.
That matters because writing “UK/EU GDPR” throughout a document can make something look straightforward and neat while hiding the questions that actually needs answering: which law applies here and what does that law require?
International transfers are probably the easiest place to see the difference.
For transfers under the EU GDPR, the European Commission’s Standard Contractual Clauses remain one of the main Article 46 safeguards. But you cannot simply write that the SCCs apply and leave it there. The parties need to enter into the SCCs as binding contractual terms, select the correct module and options and complete the relevant Annexes. A general reference to the Commission’s SCCs or a link to them is not enough.
In practice, that usually means the SCCs forming a proper part of the contractual documents, often as an attachment or schedule, so that there is no doubt about exactly which wording, modules, options and Annexes apply.
The UK position is different.
For UK restricted transfers, organisations can use the ICO (Information Commission’s Office) International Data Transfer Agreement, or the EU SCCs together with the UK Addendum. The ICO expressly allows the mandatory clauses of the IDTA and the Addendum to be incorporated by reference, provided the prescribed wording is used and the arrangement is legally binding. The relevant tables still need to be completed, or the required information provided elsewhere in the contract.
That is quite a practical difference when drafting contracts.
It is also worth remembering that the UK Addendum is not a mysterious set of UK SCCs. It works with the EU SCCs. If you are using the UK Addendum, you still need to identify the relevant EU SCC modules and clauses and make sure the underlying transfer information has actually been completed.
The United States is another good example of why the two regimes should not be blurred together. The EU-US DPF (Data Privacy Framework) and the UK Extension are connected, but they are not the same transfer mechanism. If a supplier says it is DPF certified, that should be the beginning of the check, not the end of it. You still need to confirm that the recipient is covered for the transfer you are actually making.
The same goes for transfer assessments. A UK Transfer Risk Assessment and an EU Transfer Impact Assessment are not simply two names for the same document. The underlying thinking is similar, but the legal tests and regulatory frameworks are not identical. One combined assessment may be perfectly sensible, but it still needs to deal properly with both regimes where both apply.
And do not just look at where the server sits.
A system may be hosted in London, Dublin or Frankfurt and still involve an international transfer because someone in the US, India, Japan or elsewhere can access the data. Support teams, group companies, administrators and sub processors all need to be part of the data flow analysis.
Transfers are also not the only area where the UK and EU position needs to be separated.
DPIAs are a good example. The core GDPR principles are familiar, but EU supervisory authorities can publish national lists of processing which requires a DPIA. Member State law can also affect the analysis. A DPIA written for a UK activity should not simply be rolled out across Germany, France, Ireland and the rest of the EU on the assumption that nothing changes.
The same point applies to legitimate interests. The UK framework has changed following the Data (Use and Access) Act, while EU organisations remain subject to the EU GDPR and EDPB approach. A UK LIA may give you a useful starting point, but that does not automatically make it the right assessment for EU processing.
Then there is national law.
This is sometimes the part that gets forgotten altogether. EU GDPR compliant is not always the end of the story. EU member states have their own laws sitting alongside the EU GDPR, particularly in areas such as employment data, health information, criminal offence data, children’s data, research and electronic communications.
So, when reviewing a processing activity, you should ask:
- Does the UK GDPR apply, the EU GDPR, or both?
- If the EU GDPR applies, which member state laws also need to be considered?
- Is there an international transfer, including remote access?
- Who is actually exporting the data and who is receiving it?
- Is there an adequacy decision?
- If not, which transfer mechanism is being used?
- If EU SCCs are being used, are they properly incorporated into the contract with the correct module, options and Annexes completed?
- If the UK Addendum or IDTA is being used, has it been completed properly and, if incorporated by reference, has the correct ICO wording been used?
- For US transfers, is the recipient actually covered by the relevant EU or UK DPF route?
- Has the correct UK TRA or EU TIA analysis been carried out?
- Does the DPIA deal with the right jurisdiction and any relevant national requirements?
- If legitimate interests are relied on, has the right UK or EU test been applied?
- Most importantly, does all of this match what is actually happening to the data?
That last question is usually the most useful one.
Start with the real data flow, not a contract template. Work out where the data goes, who can access it, which organisations are involved and which laws apply. Then choose the documents and safeguards that fit that reality.
In 2026, the phrase “UK/EU GDPR compliant” is becoming an increasingly unhelpful shortcut.
The regimes are still close cousins. They are just no longer interchangeable.