Skip to main content

UK General Data Protection Regulation (UK GDPR)

Jump straight to Avatar compliance regarding UK GDPR

The UK General Data Protection Regulation (UK GDPR), tailored by the Data Protection Act 2018 (DPA 2018), is the comprehensive data privacy law governing the processing of personal data in the United Kingdom. It applies to all organizations that process personal data of UK residents, regardless of where the organization is based.

The UK GDPR has been substantially amended by the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025. Most of its data protection changes came into force on 5 February 2026 (SI 2026/82). This page reflects the text in force.

Since 30 September 2026, the Information Commissioner's Office (ICO) has been replaced by the Information Commission (SI 2026/1015). The guidance cited below was published under the ICO name and is still hosted on ico.org.uk.

The European Commission renewed its adequacy decision for the UK on 19 December 2025, until 27 December 2031 (ICO). Personal data can therefore still flow from the EU to the UK without additional transfer tools.

What is Personal Data?​

According to Article 4(1) of the UK GDPR personal data refers to:

“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”

Examples: Name, email, phone number, IP address, financial information, health records.

Under Article 6 of the UK GDPR, processing personal data is only lawful if it meets one of the following conditions:

  • Consent: The individual has given explicit consent.
  • Contractual necessity: Processing is necessary for contract performance.
  • Legal obligation: Compliance with UK legal requirements.
  • Vital interests: Processing is required to protect life or health.
  • Public interest: Processing is necessary for tasks carried out in the public interest or the exercise of official authority.
  • Recognised legitimate interests: Processing is necessary for one of the purposes listed in Annex 1 (e.g. crime prevention, safeguarding, emergencies). Added by the DUAA; not available to public authorities performing their tasks.
  • Legitimate interests: The organization has a legitimate reason, provided it does not override the individual's fundamental rights.

Pseudonymization vs. Anonymization​

“means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;”

Pseudonymized data is still personal data.

  • Anonymization: Data is altered so that people are not, or no longer, identifiable. Anonymous information is no longer subject to UK GDPR.

Processing of Special Category Data​

Article 9 of the UK GDPR defines Special category data as information relating to race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, or sexual orientation. Processing such data is prohibited except under specific conditions outlined in the UK GDPR and Schedule 1 of the DPA 2018, such as:

  • Explicit consent
  • Scientific or historical research and statistics, carried out in accordance with Article 84B
  • Public health reasons
  • Legal claims

Anonymization Process Status​

The ICO states that anonymization itself counts as processing of personal data (ICO, Introduction to anonymisation):

“The end result (the anonymous information) is not subject to data protection law, but the procedure (anonymisation) is. […] This means that you must comply with data protection requirements for your anonymisation process. This includes ensuring you have a lawful basis for it and you clearly define your purpose(s) and provide people with information about it. In general it is likely that applying anonymisation techniques to the personal data you hold will be fair and lawful.”

Under Article 5(1)(b) of the UK GDPR, personal data cannot be further processed in a manner incompatible with the purposes for which it was collected. Since the DUAA, compatibility is assessed under Article 8A, which lists the factors to take into account (link between purposes, context, nature of the data, consequences, safeguards such as encryption or pseudonymisation).

For research, archiving and statistical (RAS) purposes, the law is explicit:

  • Article 84B(1)(b) allows processing for RAS purposes when it is “carried out in order to convert the personal data into information which can be processed in a manner which does not permit the identification of a data subject”, i.e. anonymization.
  • Article 8A(3)(b) treats processing carried out in accordance with Article 84B for RAS purposes as compatible with the original purpose.
  • Article 84C requires appropriate safeguards, including technical and organisational measures to respect data minimisation, such as pseudonymisation.

The concept of personal data requires that the data subject be identified or identifiable. Recital 26 specifies that information is considered anonymous where the data subject is not or no longer identifiable, taking into account all the means reasonably likely to be used, considering cost, time required, and available technology.

The ICO published its final anonymisation and pseudonymisation guidance on 28 March 2025. The ICO notes that it is under review following the DUAA. It applies a risk-based approach to anonymization, notably the Motivated Intruder Test (How do we ensure anonymisation is effective?). The status of data as anonymous depends on whether it is reasonably likely that a competent, motivated person could re-identify an individual, considering:

  • the nature and sensitivity of the data,
  • the context of use and who has access to the data,
  • the availability of other public or external datasets.

An anonymization process must be assessed and documented to demonstrate that the residual risk of re-identification is sufficiently remote. The technical assessment evaluates risks such as:

  • Singling out: isolating a single individual within a dataset,
  • Linkability: linking two datasets concerning the same individual,
  • Inference: deducing new, sensitive information about an individual.

In addition, a Data Protection Impact Assessment (DPIA) is required where processing is likely to result in a high risk. It can be used to evaluate the likelihood of potential attacks against the anonymization process, as well as their impact. If the residual risk is too high, additional technical and organizational safeguards must be implemented. When these standards are met, the data falls outside the scope of the UK GDPR.

Draft Guidance on Anonymisation, Pseudonymisation and Research​

Draft

This guidance is a consultation draft, not final guidance. The consultation runs from 24 August to 19 October 2026.

The draft guidance explains how to apply anonymisation and pseudonymisation when relying on the RAS provisions. Its main points for synthetic data are:

  • Before processing personal data for research, organizations must consider whether anonymous information can be used instead.
  • Identifiability is assessed in context: the data, who can access it, what other information they hold, the release model (public release, defined groups, internal use) and the means reasonably likely to be used.
  • Synthetic data “can reduce risks, but it is not automatically anonymous, especially if it is generated from personal data”. For synthetic data generated from personal data, the motivated intruder test should cover membership inference and attribute disclosure attacks.
  • Organizations should state what the synthetic data is suitable for, label it clearly, and document how identifiability was assessed and how safeguards will be reviewed.

Synthetic data generated using the Avatar method can fall outside the scope of the UK GDPR when its residual re-identification risk is assessed as sufficiently remote in its context of use. Here's why:

  • Converting personal data into anonymous information is expressly recognized for RAS purposes (Article 84B(1)(b)) and treated as compatible further processing (Article 8A(3)(b)). For other purposes, compatibility is assessed under Article 8A, and the ICO considers anonymization generally likely to be fair and lawful.
  • The anonymization method developed by Octopize holds a CNIL compliance certificate (EU). The UK has no equivalent certification, but its evaluation methodology follows the risk-based framework described by the ICO.
  • Anonymization can reduce identification risk and function as a technical safeguard, but whether data is anonymous depends on whether re-identification risk is sufficiently remote in its context of use.
  • Like any processing, anonymization requires a lawful basis and must be covered by the information given to data subjects. It does not require a separate consent.
  • Avatarized data that passes this assessment is not classified as personal data.

The data generated using the Avatar Method are not considered anonymous by default. Their anonymity is systematically evaluated and documented through a rigorous process involving:

  • A technical report measuring the residual re-identification risk (Singling out, Linkability and Inference) using metrics that simulate state-of-the-art attack scenarios. These include the Membership Inference and Attribute Inference attacks named in the ICO draft research guidance. The report provides the technical evidence for the Motivated Intruder Test.

  • A Data Protection Impact Assessment (DPIA) evaluating the likelihood and severity of these attacks based on data sensitivity, data recipients (the release model) and usage context.