All regulations
United Kingdom

UK GDPR & DPA 2018

The UK's own version of GDPR, applying the same core obligations to AI systems processing personal data of UK residents, with UK-specific enforcement by the ICO.

Who it applies to

  • Any organisation processing personal data of UK residents
  • Controllers and processors, including AI vendors handling UK data
  • Automated decision-making and profiling affecting UK individuals

Core obligations

  • Establish a lawful basis for every processing activity
  • Run DPIAs for high-risk AI processing
  • Provide UK data subject rights including access and objection
  • Report personal data breaches to the ICO within 72 hours

How Vigil24 helps

  • Flags AI tools processing UK personal data
  • Generates DPIA templates pre-filled from tool metadata
  • Tracks ICO-aligned breach response readiness