The UK GDPR is the UK's post-Brexit version of the EU General Data Protection Regulation. It applies alongside the Data Protection Act 2018 and is enforced by the Information Commissioner's Office (ICO).
The UK GDPR is the retained EU GDPR after Brexit, modified by the Data Protection Act 2018 (UK) and the Data (Use and Access) Act 2025 (DUAA). It applies to all processing of personal data of UK data subjects, regardless of where the controller or processor is based.
The Data (Use and Access) Act 2025 introduced the first material UK divergence from EU GDPR: lighter cookie-consent rules, an expanded list of "recognised legitimate interests" and new rules on solely automated decision-making. teamly applies the stricter standard of UK and EU GDPR by default.
Processing of staff data needs a lawful basis, usually Article 6(1)(b) (performance of contract) or 6(1)(f) (legitimate interest). For special category data (e.g. health) you additionally need an Article 9 condition. The ICO has issued specific employer guidance on monitoring at work.
A documented lawful basis, a Data Processing Agreement under Article 28 with the vendor, technical and organisational measures, documented purpose limitation, retention and deletion policy, and ICO-aligned monitoring policy. teamly provides this stack as standard.
More definitions from the teamly knowledge hub.
What HR leads, IT managers and compliance officers ask most often.
teamly is the European employee app for mid-market companies. Go-live in 3 to 6 months, your own branded app, UK and EU GDPR compliant.
