Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
Regulamentações › Reino Unido
UK GDPR
GDPR do Reino Unido e Data Protection Act 2018
QuandoEm vigor desde 1º de janeiro de 2021
Quem fiscalizaEscritório do Comissário de Informação
A quem se aplicaOrganizações estabelecidas no Reino Unido e as de fora dele que oferecem bens ou serviços a pessoas no Reino Unido ou as monitoram.
Avisar o reguladorNotificar o ICO sem demora injustificada e, sempre que possível, em até 72 horas após tomar conhecimento, sal…
DPO obrigatórioDPO obrigatório para autoridades públicas, monitoramento sistemático em larga escala ou categorias especiais em larga…
RegistroA maioria dos controladores deve pagar uma taxa anual de proteção de dados ao ICO, salvo isenção
Transferências para o exteriorTransferências exigem regulamentos de adequação do Reino Unido segundo um teste de proteção de dados 'não substancialmente inferior', ou…
Prazo para solicitaçõesResponder em até um mês, prorrogável por dois meses
Multa máximaAté GBP 17.5 milhões ou 4% do faturamento anual mundial, o que for maior
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance e base legal
Alcance extraterritorial
2
Applies to non-UK controllers offering goods or services to, or monitoring behavior of, people in the UK.UK GDPR Art. 3(2) · source ↗
Not re-verified against the source this session.
Base legal
1
Six GDPR bases plus a new 'recognised legitimate interests' basis (Annex 1) needing no balancing test, in force 5 Feb 2026.UK GDPR Art. 6(1)(ea), Annex 1 · source ↗
Annex 1 confirmed on legislation.gov.uk; commencement date from RPC (SI 2026/82). Art. 6(1)(ea) numbering not separately verified.
Consentimento
2
Consent must be freely given, specific, informed and unambiguous; DUAA permits consent to broad areas of scientific research.UK GDPR Art. 4(11), Art. 7 · source ↗
Not re-verified against the source this session.
Dados sensíveis
2
Special categories prohibited unless explicit consent or listed condition applies; many conditions need an appropriate policy document.UK GDPR Art. 9; DPA 2018 s.10, Sch. 1 · source ↗
Not re-verified against the source this session.
Crianças
1
Age of consent for information society services is 13; online services likely accessed by children must consider children's higher protection in design.DPA 2018 s.9; UK GDPR Art. 8; Art. 25 as amended by DUAA · source ↗
ICO Age Appropriate Design Code applies to under-18s. DUAA children's design duty in force 5 Feb 2026 per RPC.
Direitos das pessoas
Direitos
3
Access, rectification, erasure, restriction, portability, objection, and safeguards on significant automated decisions, plus a right to complain to the controller.UK GDPR Arts. 15-21, 22A-22D · source ↗
Arts. 22A-22D confirmed on legislation.gov.uk. Controller complaint procedures (DUAA s.103) commenced 19 June 2026 per RPC.
Prazo para solicitações
2
Respond within one month, extendable by two months; clock can pause while awaiting clarification; reasonable and proportionate searches suffice.UK GDPR Art. 12(3), Art. 12A · source ↗
Art. 12A text not displayed on the page read; stop-the-clock detail from GOV.UK and RPC summaries.
Marketing
2
Prior consent needed for electronic marketing, with soft opt-in for existing customers (extended to charities by DUAA); absolute right to object.PECR 2003 reg. 22; UK GDPR Art. 21(2)-(3) · source ↗
PECR and DUAA charity soft opt-in section not fetched; commencement of the charity extension not confirmed.
Governança
DPO obrigatório
1
DPO required for public authorities, large-scale systematic monitoring, or large-scale special-category or criminal data processing.UK GDPR Art. 37(1) · source ↗
Not re-verified against the source this session.
Qualificações do DPO
1
DPO designated on professional qualities and expert knowledge of data protection law and practice.UK GDPR Art. 37(5) · source ↗
Not re-verified against the source this session.
Registro
2
Most controllers must pay an annual data protection fee to the ICO unless exempt.Data Protection (Charges and Information) Regulations 2018 (SI 2018/480) reg. 2 · source ↗
Regulation not fetched this session; tiered fee, not licensing.
DPIA
2
DPIA required before processing likely to result in high risk; consult the ICO if high risk remains.UK GDPR Art. 35, Art. 36 · source ↗
Not re-verified against the source this session.
Registros
2
Records of processing required; limited exemption for organizations under 250 employees doing occasional, low-risk processing.UK GDPR Art. 30 · source ↗
Not re-verified against the source this session.
Retenção
1
Storage limitation: keep identifiable data no longer than necessary.UK GDPR Art. 5(1)(e) · source ↗
Not re-verified against the source this session.
Violações
Avisar o regulador
2
Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.UK GDPR Art. 33(1) · source ↗
Not re-verified against the source this session.
Informar as pessoas
2
Notify affected individuals without undue delay when the breach is likely to result in high risk.UK GDPR Art. 34(1) · source ↗
Not re-verified against the source this session.
Transferências
Transferências para o exterior
2
Transfers need UK adequacy regulations under a 'not materially lower' data protection test, or appropriate safeguards such as the IDTA or Addendum.UK GDPR Arts. 45A-45C, 46 · source ↗
Arts. 45A-45C confirmed on legislation.gov.uk; in force 5 Feb 2026 per RPC.
Fiscalização
Multa máxima
3
Up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher; PECR fines now aligned to the same level.DPA 2018 s.157; DUAA Sch. 13 (PECR) · source ↗
s.157 not fetched; PECR alignment from RPC commencement summary.
Responsabilidade criminal
1
Listed offenses (unlawful obtaining, re-identification, altering records to prevent disclosure) punishable by fines; directors can be liable.DPA 2018 ss.170, 171, 173, 198 · source ↗
Not re-verified against the source this session. Fines only; no imprisonment.
Ação privada
2
Individuals can claim compensation for material or non-material damage; representative actions are limited in practice.UK GDPR Art. 82; DPA 2018 s.168 · source ↗
Not re-verified against the source this session.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais