---
title: "Decide whether UK data protection law · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/scope-and-ownership/uk-data-protection
id: CMP-91
level: Recommended
region: UK
updated: 2026-10-27
build: a2a6bdfed830
tokens: 750
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Decide whether UK data protection law covers you

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-91
- Level: Recommended
- Chapter: [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md)
- Rule: Record whether you have a UK establishment or offer goods or services to people in the UK. If so, meet the UK GDPR as the Data (Use and Access) Act 2025 changed it.
- Check: The facts file records UK customers and establishment. When either is true, the obligations register has a `uk_gdpr` entry and a named UK representative or establishment. A test can open the complaints channel.
- Region: United Kingdom (UK). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: The UK GDPR and the Data Protection Act 2018 also cover a business abroad that offers goods or services to people in the UK. Such a business also names a UK representative. The Data (Use and Access) Act 2025 changed both laws in stages over 12 months. Since 19 June 2026, controllers must run a way to take data protection complaints and acknowledge each one within 30 days. The Act also eases some rules, such as some cookies for analytics. The Information Commissioner's Office, ICO, supervises. Keep the UK answers next to the EU ones in the [obligations register](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register.md).

## Sources

- [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/contents)
- [UK GDPR](https://www.legislation.gov.uk/eur/2016/679/contents)
- [ICO, data protection and the EU](https://ico.org.uk/for-organisations/data-protection-and-the-eu/)

## Related rules

- CMP-1 [Keep a register of every duty that applies](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/scope-and-ownership/uk-data-protection">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Run a whistleblowing channel once you have 50 workers](https://agentwranglers.se/playbook/compliance/scope-and-ownership/whistleblowing-channel.md)
- Next: [Decide whether the Swiss data protection act covers you](https://agentwranglers.se/playbook/compliance/scope-and-ownership/swiss-data-protection.md)
- [Scope and ownership](https://agentwranglers.se/playbook/compliance/scope-and-ownership.md)