This Practice Note tracks Enforcement actions in the UK by the UK Information Commissioner’s Office (ICO) under:

1. •

   the EU’s General Data protection Regulation, Regulation (EU) 2016/679 (EU GDPR) regime (applicable under UK law until the end of the Brexit implementation period at 11 pm UK time on 31 December 2020), and

2. •

   the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) regime (applicable under UK law from the end of the Brexit implementation period on 31 December 2020)

Assimilated law is the name given to retained EU law which remains in force after the end of 2023. For information about the background to the UK GDPR and its relationship with the EU GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR)—Summary of key legislation.

Entries may adopt common data protection abbreviations such as DPIA (for data protection impact assessment) and DSAR (data subject access request)—for an introduction to the area and to key terms, see Practice Notes: Data protection law—new starter guide