United Kingdom

Territorial reach comes from Article 3 of the UK GDPR; the representative duty is Article 27. The regulator's own guidance stresses that a website merely being reachable from Britain is not enough — it looks for deliberate targeting such as pricing in pounds, a .co.uk address, British marketing or British delivery. 'Monitoring behaviour' is read broadly and covers one-off profiling, not just continuous tracking. The regulator also notes that the representative is not itself the enforcement target: it pursues the overseas company. The February 2026 fine against Reddit, a United States company, shows this is not theoretical.

Sector by sector, checked on 18 August 2026. TELECOMS — the strictest layer. The Electronic Communications (Security Measures) Regulations 2022 require a network provider to be able to run its network 'without reliance on persons, equipment or stored data located outside the United Kingdom', and regulation 9(2)(a) requires certain backup information to be retained within the United Kingdom. That is a genuine copy-must-stay rule. HEALTH — National Health Service and social care data, including confidential patient information, may be held in public cloud, but only in the United Kingdom, the European Economic Area, or a country the United Kingdom has declared adequate. In practice that removes the standard-contract route that other industries can use. GOVERNMENT — data marked OFFICIAL may sit overseas; the Cabinet Office guidance says in terms that there is no universal requirement for it to be in the United Kingdom. But public cloud is not permitted for SECRET or TOP SECRET at all. FINANCE — the regulators impose access, audit, resilience and exit requirements, and from 13 July 2026 four cloud providers are directly supervised, but there is no requirement to keep the data in Britain. GAMBLING — a common myth. Putting remote gambling equipment in Great Britain triggers a licensing requirement; it is not a rule that the equipment must be there. MAPPING AND GEOSPATIAL — no location rule found, checked 18 August 2026, confidence medium.

Three routes: adequacy regulations (the 'data bridges'), appropriate safeguards, or a narrow exception. The main safeguard is the International Data Transfer Agreement, or the Addendum that bolts onto the European standard clauses. Group-wide binding corporate rules are also available. Canada is covered only for private-sector bodies under its federal privacy law, Japan only for private-sector bodies under its own act, and the United States only through the UK Extension to the EU-US Data Privacy Framework, which means only certified American organisations. The Data (Use and Access) Act 2025 replaced the old 'essentially equivalent' test with a lower 'not materially lower' standard, and codified a risk-based approach to the exporter's own assessment. The regulator refreshed its transfer guidance on 15 January 2026. Flows the other way — from the European Union into the United Kingdom — depend on the European Commission's renewed adequacy decisions of 19 December 2025, which run to 27 December 2031.

The Information Commission was incorporated on 20 August 2025 under the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Its own first annual report says there was 'no operational activity during the period from 20 August 2025 to 31 March 2026', that it had no employees, and that the secondary legislation transferring functions to it 'has not yet been laid'. Until that transfer happens, every notice, fine and decision comes from the Information Commissioner. Sector regulators are separately active: the Financial Conduct Authority and the Bank of England's Prudential Regulation Authority began direct oversight of designated cloud providers on 13 July 2026; the communications regulator Ofcom is running an enforcement programme on age checks under the Online Safety Act; and the telecoms security regime is supervised by Ofcom under the Communications Act.

The ceiling is the storage limitation principle in Article 5(1)(e) of the UK GDPR — no fixed number, a documented and justified period. The floors we verified: company accounting records must be kept for six years from the end of the financial year they relate to, longer if a tax enquiry is open; a retention notice under the Investigatory Powers Act 2016 may require a telecoms operator to hold communications data, including internet connection records, for a maximum of twelve months; the telecoms security regulations require access data to be 'held securely for at least 13 months' and other security records for at least three years. Anti-money-laundering record keeping is generally five years, but we did not verify that against an official source in this run. The conflict is resolved by the lawful-obligation basis: where another law requires retention, that is the legal ground for continuing to hold the data, and the deletion duty does not bite until the statutory period ends.

Clock one: UK GDPR Article 33, 72 hours from becoming aware, to the Information Commissioner. Clock two: the Privacy and Electronic Communications Regulations, which apply to providers of public electronic communications services. The regulator's own guidance now states 'You must notify the ICO within 72 hours of becoming aware of the essential facts of the breach', a change made by the Data (Use and Access) Act 2025 on 20 August 2025; the old rule was 24 hours and a great deal of stale advice still says so. A separate fixed £1,000 penalty applies for failing to file that notification at all. Clock three: regulation 11 of the Network and Information Systems Regulations 2018 — 'without undue delay and in any event no later than 72 hours' to the relevant competent authority. Financial firms have a fourth, less precise clock: notify the Financial Conduct Authority of anything significant without delay. The overlap is where people fail: the same incident can be reportable to the privacy regulator, a sector regulator and, for designated cloud providers, under the critical third parties regime.

(1) The children's code is a statutory code made under section 123 of the Data Protection Act 2018 and applies to any online service likely to be accessed by children in the United Kingdom. Note also that the age-of-consent provision people cite, section 9 of the Data Protection Act 2018, was deleted on 31 December 2020; the 13-year rule now lives in Article 8 of the UK GDPR. Separately, the Online Safety Act requires 'highly effective age assurance' for pornographic content since July 2025, policed by Ofcom, which is a different regulator with different powers. (2) Regulation 9(2)(a) of the telecoms security regulations. (3) National Health Service and social care guidance permits only the United Kingdom, the European Economic Area and countries with UK adequacy. (4) The Data Protection Act 2018 creates criminal offences, including knowingly obtaining or disclosing personal data without the controller's consent and altering records to frustrate a subject access request; these attach to individuals as well as companies. (5) Technical capability notices under the Investigatory Powers Act 2016 are secret, are not published, and can reach companies outside the United Kingdom; Apple's challenge is before the Investigatory Powers Tribunal and a second challenge was reported in August 2026. Bonus trap: the immigration exemption in Schedule 2 to the Data Protection Act 2018 was held incompatible by the Court of Appeal in 2021, suspended, and rewritten twice, most recently in March 2024 — treat any reliance on it as legally fragile.

Pending legislation: the Cyber Security and Resilience (Network and Information Systems) Bill, House of Lords Bill 32 of 2026-27, had its second reading in the Lords on 14 July 2026. It expands the 2018 regime to data centres, electrical load control and third-party information technology suppliers, with much of the detail left to later secondary legislation. Dormant switches that could change the picture with no consultation: (1) the Secretary of State may serve a retention notice on a telecoms operator at any time, up to twelve months of data, and the notice is not published; (2) technical capability notices under the same Act are secret and have already been used against a major cloud provider; (3) HM Treasury can designate further critical third parties by statutory instrument, as it did for four cloud providers on 8 July 2026 with effect five days later; (4) the European Commission's renewed adequacy decision for the United Kingdom runs to 27 December 2031 but can be suspended if British law diverges; (5) ministers can commence the remaining parts of the Data (Use and Access) Act 2025, including the transfer of the regulator's functions, by regulations alone.