If you run a small British business and handle personal data, you are working under UK GDPR — the version of the EU's General Data Protection Regulation kept on the UK statute book after Brexit, sitting alongside the Data Protection Act 2018. The Information Commissioner's Office enforces it.

There is a second regime in the room, though. EU GDPR still applies to you if you offer goods or services to people in the EU, or monitor their behaviour, even with no office there. For a Bristol shop selling locally, that rarely matters. For a Manchester software firm with customers in Ireland and Germany, both laws apply at once — and getting the small divergences right saves real time and money.

Two documents, one shared core

Both regimes rest on the same principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. The lawful bases match. So do the individual rights, the 72-hour breach notification window, the DPIA requirement for high-risk processing, and broadly similar fine ceilings.

That overlap is useful. Build your policies around the shared core and you will be compliant with both for most purposes. The differences are where the work sits.

Subject access: the same clock, different local habits

Both regimes give people the right to a copy of their data, and both require a response without undue delay and within one month. Both allow up to two further months for genuinely complex requests, and both let you refuse or charge a reasonable fee for manifestly unfounded or excessive ones. Both start the clock when you have what you need to identify the requester — so if you ask for ID, the month runs from the day it arrives, not the day the email landed.

The practical differences are in the detail and the enforcement culture:

• National carve-outs. The Data Protection Act 2018 contains exemptions and separate access routes for certain health, social work and education records. EU member states have their own equivalents, often with different forms attached.
• Search standards. UK reforms now ask for a search that is reasonable and proportionate to the request. That is a useful defence, but not a licence for a half-hearted trawl — document what you searched and why you stopped.
• Complaint routes. UK changes mean individuals may need to complain to you first before going to the ICO. In the EU, they can generally go straight to their national supervisory authority.
• Language. With 27 EU regulators, expect local-language requests and responses in some member states. The ICO works in English.

A simple SAR log — date received, date ID received, day 30, extension reason, response date — will keep you straight under both.

International transfers: where the real gap sits

This is where the two regimes most visibly part company. The paperwork is not interchangeable, so assume nothing.

• EU to UK. Flows rely on the EU's adequacy decision for the UK, which has been renewed on a time-limited basis. Check the current expiry date before promising a client that data can move freely for the next five years.
• UK to EEA. The UK treats the EEA as adequate, so no extra mechanism is needed.
• UK exports further afield. Use the International Data Transfer Agreement, or the UK Addendum to the EU's standard contractual clauses, plus a transfer risk assessment.
• EU exports further afield. Use the 2021 EU SCCs plus a transfer impact assessment. You cannot swap one signature block for the other.
• The US. The UK Extension to the EU-US Data Privacy Framework and the EU-US framework keep separate self-certification lists. A company on one is not automatically on the other.
• Representatives. If you have no EU establishment but target EU individuals, EU GDPR generally requires an EU representative under Article 27, with narrow exemptions. The UK dropped the equivalent requirement, so you do not need a UK representative.

Record-keeping: does a small business really need a ROPA?

Article 30 of both regimes requires records of processing activities. Both exempt organisations with fewer than 250 employees, then hollow the exemption out: it does not apply where processing is regular and ongoing, is likely to result in a risk to individuals, or involves special category or criminal offence data.

Read that carefully. Routine HR processing, a customer database, a mailing list and any health or ethnicity data all fall outside. In practice, most small businesses should keep a record of processing.

The UK has narrowed its own requirement so it bites mainly on processing likely to result in high risk to individuals. That is a real reduction, but keep the record anyway — it is the document you reach for when a SAR lands, a processor asks questions, or you need to assess a breach.

Other differences worth knowing

• Age of consent for online services: 13 in the UK; EU member states may set it between 13 and 16.
• Maximum fines: up to £17.5 million or 4% of global annual turnover in the UK; up to €20 million or 4% in the EU.
• One-stop-shop: EU businesses deal with a lead supervisory authority. There is no UK equivalent — the ICO is your regulator.
• Cookies: the UK's PECR sits alongside UK GDPR, while EU countries apply the ePrivacy Directive. The UK has moved towards lighter-touch consent for low-risk analytics.
• Children's data: the UK's Age Appropriate Design Code sets specific expectations for services likely to be accessed by children.

A practical way to keep both straight

1. Map where your data subjects are. UK-only, EU, or both — and be honest about EU visitors hitting your website.
2. If you target EU individuals, decide whether Article 27 requires an EU representative.
3. Run one record of processing and tag entries by regime, so you can see which flows cross which border.
4. Handle every SAR to the stricter common standard: one month, no extension unless the request is genuinely complex.
5. Re-paper transfer contracts. IDTA or UK Addendum for UK exports, EU SCCs for EU exports, and file the risk assessments with the signed documents.
6. Diarise a check of ICO and European Data Protection Board guidance. UK data reforms are being commenced in stages, so guidance moves faster than the statute.

None of this needs to be heavy. A one-page transfer map, a SAR log and a tidy record of processing will cover most of the ground for a small team. Where a decision carries real commercial weight — a new US vendor, an EU subsidiary, a data-sharing deal — take advice from a data protection solicitor or the ICO's own guidance rather than guessing. This is general information, not legal advice.

Photo: advogadoaguilar / Pixabay