United Kingdom

The reach comes from Article 3 of the UK GDPR, Britain's main privacy law. The duty to name a representative is Article 27. The regulator's own guidance stresses that a website simply being reachable from Britain is not enough. It looks for deliberate targeting. Examples are pricing in pounds, a .co.uk address, British marketing or British delivery. Watching what people do is read broadly. It covers one-off profiling, not just continuous tracking. The regulator also says the representative is not the target of enforcement. It goes after the overseas company itself. The February 2026 fine against Reddit, a United States company, shows this really happens.

Industry by industry, checked on 18 August 2026. TELECOMS. The strictest layer. The Electronic Communications (Security Measures) Regulations 2022 apply here. A network provider must be able to run its network without relying on people, equipment or stored data outside the United Kingdom. Regulation 9(2)(a) also requires certain backup information to be kept within the United Kingdom. That is a real must-stay-here copy rule. HEALTH. National Health Service and social care data, including confidential patient information, may be held in public cloud. But it may only sit in the United Kingdom, the European Economic Area, or a country the United Kingdom has formally approved as safe enough. That removes the standard contract route other industries can use. GOVERNMENT. Data marked OFFICIAL may sit overseas. The Cabinet Office guidance says plainly that there is no universal requirement to keep it in the United Kingdom. But public cloud is not allowed for SECRET or TOP SECRET at all. FINANCE. The regulators require access, audit, resilience and exit arrangements. From 13 July 2026 four cloud providers are supervised directly. But there is no requirement to keep the data in Britain. GAMBLING. A common myth. Putting remote gambling equipment in Great Britain means you need a licence. It is not a rule that the equipment must be there. MAPPING AND GEOSPATIAL. We found no location rule, checked 18 August 2026, confidence medium.

There are three routes. One, the destination is covered by official regulations saying it is safe enough. The government calls these data bridges. Two, you put approved safeguards in place. Three, a narrow exception applies. The main safeguard is the International Data Transfer Agreement. You can also use the Addendum that bolts onto the European standard clauses. Group-wide binding corporate rules are available too. Some approvals are partial. Canada is covered only for private-sector bodies under its federal privacy law. Japan is covered only for private-sector bodies under its own act. The United States is covered only through the UK Extension to the EU-US Data Privacy Framework. That means only certified American organisations. The Data (Use and Access) Act 2025 replaced the old 'essentially equivalent' test with a lower 'not materially lower' test. It also wrote a risk-based approach into the exporter's own assessment. The regulator refreshed its transfer guidance on 15 January 2026. Flows the other way, from the European Union into the United Kingdom, depend on the European Commission's renewed decisions of 19 December 2025. Those run to 27 December 2031.

The Information Commission was set up on 20 August 2025 under the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Its own first annual report says there was 'no operational activity during the period from 20 August 2025 to 31 March 2026'. It had no employees. The report also says the secondary legislation transferring functions to it 'has not yet been laid'. Until that transfer happens, every notice, fine and decision comes from the Information Commissioner. Industry regulators are separately active. The Financial Conduct Authority and the Bank of England's Prudential Regulation Authority began direct oversight of designated cloud providers on 13 July 2026. The communications regulator Ofcom is running an enforcement programme on age checks under the Online Safety Act. Ofcom also supervises telecoms security under the Communications Act.

The maximum comes from the storage limitation rule in the UK GDPR, Britain's main privacy law. There is no fixed number. You need a period you have written down and can justify. The minimums we verified. Company accounting records must be kept for six years from the end of the financial year they relate to. Keep them longer if a tax enquiry is open. A retention notice under the Investigatory Powers Act 2016 can require a telecoms operator to hold communications data. The maximum is twelve months. This includes internet connection records. The telecoms security regulations require access data to be 'held securely for at least 13 months', and other security records for at least three years. Anti-money-laundering records are generally kept five years, but we did not verify that against an official source. The clash is settled by the legal duty ground. Where another law requires you to keep data, that law is your legal reason for holding it. The duty to delete does not apply until the statutory period ends.

Clock one. British privacy law: 72 hours from becoming aware, to the Information Commissioner. Clock two. The Privacy and Electronic Communications Regulations, which apply to providers of public electronic communications services. The regulator's own guidance now says you must notify the Information Commissioner's Office within 72 hours of becoming aware of the essential facts of the breach. The Data (Use and Access) Act 2025 made that change on 20 August 2025. The old rule was 24 hours, and a great deal of stale advice still says so. A separate fixed penalty of 1,000 pounds applies if you fail to file that notification at all. Clock three. Regulation 11 of the Network and Information Systems Regulations 2018: 'without undue delay and in any event no later than 72 hours' to the relevant competent authority. Financial firms have a fourth, vaguer clock. Tell the Financial Conduct Authority about anything significant without delay. The overlap is where people fail. One incident can be reportable to the privacy regulator, to an industry regulator, and, for designated cloud providers, under the critical third parties rules.

(1) The children's code is a statutory code made under section 123 of the Data Protection Act 2018. It applies to any online service likely to be accessed by children in the United Kingdom. People often cite section 9 of the Data Protection Act 2018 for the age of consent. That section was deleted on 31 December 2020. The 13-year rule now lives in Article 8 of the UK GDPR. Separately, the Online Safety Act has required 'highly effective age assurance' for pornographic content since July 2025. Ofcom polices that. It is a different regulator with different powers. (2) Regulation 9(2)(a) of the telecoms security regulations. (3) National Health Service and social care guidance permits only the United Kingdom, the European Economic Area, and countries the United Kingdom has formally approved. (4) The Data Protection Act 2018 creates criminal offences. One is knowingly obtaining or disclosing personal data without the consent of the company that decides how the data is used. Another is altering records to frustrate a request for a copy of someone's data. These offences attach to individuals as well as companies. (5) Technical capability notices under the Investigatory Powers Act 2016 are secret. They are not published, and they can reach companies outside the United Kingdom. Apple's challenge is before the Investigatory Powers Tribunal. A second challenge was reported in August 2026. BONUS TRAP. The immigration exemption in Schedule 2 to the Data Protection Act 2018 was held incompatible by the Court of Appeal in 2021. It was suspended, then rewritten twice, most recently in March 2024. Treat any reliance on it as legally fragile.

PENDING LEGISLATION. The Cyber Security and Resilience (Network and Information Systems) Bill is House of Lords Bill 32 of 2026-27. It had its second reading in the Lords on 14 July 2026. It expands the 2018 rules to data centres, electrical load control and third-party information technology suppliers. Much of the detail is left to later secondary legislation. THINGS THAT COULD CHANGE WITH NO CONSULTATION. (1) The Secretary of State can serve a retention notice on a telecoms operator at any time, covering up to twelve months of data. The notice is not published. (2) Technical capability notices under the same Act are secret and have already been used against a major cloud provider. (3) HM Treasury can designate further critical third parties by secondary legislation. It did so for four cloud providers on 8 July 2026, taking effect five days later. (4) The European Commission's renewed decision on the United Kingdom runs to 27 December 2031. It can be suspended if British law drifts away from European standards. (5) Ministers can switch on the remaining parts of the Data (Use and Access) Act 2025 by regulations alone. That includes transferring the regulator's functions.