Why GDPR Still Matters
Since Brexit, UK businesses have had to navigate a dual compliance regime: the UK GDPR, retained from the EU’s General Data Protection Regulation (GDPR), and the EU GDPR itself, where applicable. Contrary to what some business leaders might hope, GDPR hasn’t gone away, it’s gotten smarter, deeper, and more intertwined with emerging technologies like artificial intelligence (AI) and global data flows.
As we move into 2025, practitioners refer to this next chapter as “GDPR 3.0”, not a new law, but a shift in focus: more sophisticated guidance, updated enforcement priorities, and a deeper emphasis on risk-based compliance.
What is “GDPR 3.0”?
There’s no official regulation titled GDPR 3.0. Instead, it’s a term used by privacy professionals to describe the third major phase in the evolution of data protection law and its implementation:
- GDPR 1.0 (2018 –2020): First rollout of core compliance: cookie banners, privacy notices, subject access protocols, and data security basics.
- GDPR 2.0 (2020 –2023): Ad justments after major rulings like Schrems II, re-evaluation of international transfers, strengthening of DPIAs and LIAs.
- GDPR 3.0 (2024 –2026): A maturity phase focusing on AI, automated decision-making, proportionality, data ethics, and new UK-specific reforms.
The EU and UK regulators are converging on shared risk-based principles, yet their implementation tools, including the new UK Data (Use and Access) Act 2025 (DUAA), signal a divergence in how this shared vision plays out.
The Legal Landscape: Key Developments in 2025
UK GDPR and the Data (Use and Access) Act 2025
The DUAA, passed in June 2025, modernises and localises the UK’s approach to data use. While it retains most of the UK GDPR’s structure, it:
- Encourages Smart Data initiatives (like Open Banking) to standardise consumer-controlled data sharing.
- Clarifies digital identity verification services and creates new certification requirements.
- Refines accountability and transparency obligations, requiring more rigorous documentation when repurposing data.
- Grants regulators and ministers clearer powers to issue rules, raising concerns about oversight and flexibility.
Despite these changes, most organisations won’t need to overhaul their compliance programmes. Instead, they should review internal policies, DPIAs, and ROPAs to incorporate DUAA-specific duties, especially if engaging with Smart Data or digital identity services.
The EU’s Continuing Influence
The UK is currently considered an “adequate” jurisdiction under EU law, allowing free data flows between the UK and the EU without added safeguards. However, this status is under periodic review. Any significant divergence (e.g., due to DUAA reforms) may jeopardise adequacy, forcing UK businesses to rely on Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).
The UK-US Data Bridge, implemented in 2023, allows data to flow to certified US businesses under a UK-specific framework, parallel to the EU’s Data Privacy Framework.
Updated Regulatory Guidance: Legitimate Interests & AI
EDPB Guidance 1/2024: Legitimate Interests
The European Data Protection Board (EDPB) revised its guidance on the Article 6(1)(f) legitimate interest basis. The updated test requires:
- A clearly defined and lawful purpose.
- A demonstrated necessity for using the data.
- A documented balancing test, including safeguards for data subjects.
The guidance includes templates and detailed examples, particularly for AI-driven processing. For instance, profiling for dynamic pricing now requires a careful assessment of potential discrimination and meaningful mitigations.
AI and Article 22: Automated Decision-Making
The EDPB’s Opinion 28/2024 on AI emphasises that where automated decision-making produces legal or similarly significant effects, data subjects must have:
- Human intervention that is genuinely meaningful.
- The ability to contest decisions.
- Transparent explanations of the logic involved.
The UK ICO aligns broadly with this view but encourages risk-based pragmatism, urging firms to avoid “box-ticking” and instead focus on accountability and human oversight.
Territorial Scope: The Reach of GDPR
Many UK firms mistakenly believe that Brexit exempts them from EU GDPR. In fact, any UK organisation that monitors EU residents or offers goods/services to them must still comply with EU GDPR (Article 3).
This often includes:
- Behavioural advertising with EU traffic.
- Analytics and cookies used without consent.
- Automated email marketing targeting EU subscribers.
Firms must also consider appointing an EU representative and keeping a dual regime of compliance documentation and breach protocols.
The Real Risks: More Than Just Fines
Regulators are increasingly using tools beyond monetary penalties:
- Corrective Orders: Mandating the suspension of unlawful processing.
- Public Reprimands: Damaging brand trust and investor relations.
- Reputational Fallout: Media exposure, consumer backlash, and social media scrutiny.
- Litigation: Group claims, especially where data subject rights or children’s data are involved.
The maximum fines remain significant: £17.5 million or 4% of global turnover (UK GDPR); €20 million or 4% (EU GDPR).
WordPress and Web Compliance: Practical Steps
WordPress is still the most-used CMS globally. It collects personal data out-of-the-box (e.g., through comments, cookies, analytics), and many UK SMEs rely on it. Here’s how to ensure compliance:
Use a GDPR-Ready Consent Plugin
Recommended tools:
- Complianz: Auto-scans cookies, geo-targets consent banners.
- Iubenda: Offers customisable privacy policies and legal documents.
- WPForms: Includes consent fields and subject access request (SAR) export tools.
- MonsterInsights: Integrates Google Analytics with GDPR toggles and IP anonymisation.
Block Scripts Before Consent
Ensure that non-essential scripts (ads, social media widgets, tracking) only run after users opt-in.
- Never use pre-ticked checkboxes.
- Include granular categories: performance, analytics, marketing.
Enable Data Rights Tools
WordPress includes features to export or delete user data. Ensure SARs can be completed within
30 days and develop identity verification procedures.
Third-Party Scripts: Know Your Stack
Every embedded service is a data controller or processor. Keep a register of third-party scripts, conduct due diligence, and sign
Data Processing Agreements (DPAs)
where needed.
Security Measures
Article 32 of the GDPR requires proper technical and organisational security. For WordPress users, this includes:
- SSL encryption.
- Secure admin access (e.g., 2FA).
- Firewall and anti-malware tools.
- Regular updates of themes, plugins, and the CMS itself.
Governance and Documentation
Keep These Three Records
Documentation must be auditable, up-to-date, and tailored.
- Records of Processing Activities (ROPA): Must cover data categories, recipients, transfers, and retention.
- Legitimate Interest Assessments (LIA): Needed when relying on Article 6(1)(f).
- Data Protection Impact Assessments (DPIA): Mandatory for high-risk processing like AI profiling, biometrics, or large-scale monitoring.
Training and Culture
Train teams by role:
- Marketing: Consent and analytics.
- Engineering: Data minimisation, secure coding.
- HR: Data access and SARs.
Privacy should be embedded in product development, procurement, and risk management workflows.
AI, Profiling, and Human Oversight
If your organisation uses AI for:
- Credit scoring.
- Employee evaluation.
- Price personalisation.
- Behavioural advertising.
Then you may trigger Article 22 protections. You’ll need to:
- Justify your legal basis (consent or legitimate interest).
- Explain how the model works.
- Offer human appeal routes.
You should also assess implications of the EU AI Act, even if you’re UK-based, as your vendors or clients may impose compliance via contracts.
International Data Transfers
Tools to Use in 2025
- EU SCCs (June 2021 version) + UK Addendum.
- UK IDTA (2022).
- UK-US Data Bridge provided the US recipient is certified.
- Transfer Risk Assessments (TRAs) for sensitive destinations (e.g., India, China).
Build internal playbooks to adapt if adequacy decisions change. This includes fallback contractual clauses and enforcement procedures.
Your 10-Point Compliance Action Plan
- Refresh your ROPA to include AI, international transfers, and profiling.
- Re-run LIAs using latest templates.
- Scan your site with Complianz/Iubenda.
- Block non-essential cookies until consent.
- Update all DPAs with vendors and partners.
- Document DPIAs for any new high-risk use case.
- Run a 72-hour breach simulation.
- Enable 2FA and SSL across all systems.
- Deliver tailored training and log attendance.
- Schedule quarterly mini audits.
Conclusion: Privacy as a Competitive Advantage
In this new phase of data governance, GDPR compliance has evolved from a regulatory obligation into a strategic advantage. It’s no longer just about mitigating risk, it’s about cultivating trust, proving digital maturity, and enabling ethical innovation.
UK businesses should treat data protection not as a one-off project, but as an integral part of product design, stakeholder communication, and operational resilience. Organisations that approach GDPR as a design principle, not just a legal hurdle, are better positioned to innovate responsibly and build customer loyalty.
By embracing transparency, embedding privacy in every layer of decision-making, and preparing for what’s next, UK businesses can navigate 2025 and beyond with confidence.