Home › Compare laws side by side › UK Online Safety Act vs EU GDPR
UK Online Safety Act vs EU GDPR
Online Safety Act 2023 (United Kingdom) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | UK Online Safety Act United Kingdom ✓ Confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force. Royal Assent 26 Oct 2023; duties phased in by Ofcom codes and commencement regulations. Part 5 age checks since 17 Jan 2025; illegal content duties enforceable since 17 Mar 2025; child-safety duties since 25 Jul 2025; CSEA reporting to the NCA (user-to-user services) since 7 Apr 2026. Most extra duties for categorised services are still being consulted on (final statements expected by mid-2027).✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | User-to-user services (social media, forums, messaging, gaming, dating, file-sharing, etc.), search services, and providers that publish their own pornographic content (Part 5), wherever based, if they have UK links: a significant number of UK users; the UK as a target market (or the only one); or the service can be used in the UK and there is a material risk of significant harm to people in the UK. Some services are exempt (Sch 1 and 2).✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold for core duties. Extra duties for categorised services (SI 2025/226), by average monthly active UK users: Category 1 = user-to-user with a recommender system and >34m users, or >7m users plus resharing; Category 2A = search >7m users (not narrow vertical search); Category 2B = user-to-user with direct messaging and >3m users. Ofcom published the register in July 2026 (10 Category 1, 4 Category 2A, 25 Category 2B services, plus 4 on an 'emerging Category 1' list). Fees: providers with qualifying worldwide revenue (QWR) of £250m or more must notify Ofcom and pay fees (SI 2025/1204), unless UK referable revenue is under £10m.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Ofcom (Office of Communications)✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | No general incident-notification duty. Since 7 Apr 2026, regulated user-to-user services must report detected, unreported child sexual exploitation and abuse (CSEA) content to the National Crime Agency (UK providers: all such content; non-UK providers: UK-linked content), in the form and timeframes set by SI 2026/268. Content already reported to a qualifying foreign body such as NCMEC need not be re-reported. The duty is not yet applied to search services.✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | N/A✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Ofcom's illegal content codes say every service should name an individual accountable to its most senior governance body for the illegal content safety duties and reporting and complaints duties (ICU A2 / ICS A2). Small services without a board can report to a senior manager responsible for online safety.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No UK-representative requirement was found in the Act. Ofcom can require a provider to name a senior manager in an information notice (s.103); that person can be criminally liable if the company fails to comply and they did not take all reasonable steps to prevent it (s.110).✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | N/A✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Age assurance, not consent. Part 5 porn publishers must use highly effective age assurance (since 17 Jan 2025). Since 25 Jul 2025, services likely to be accessed by children must meet the child-safety duties; services that allow pornographic content must use highly effective age assurance to stop children readily accessing it.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater (Sch 13 para 4). Ofcom can also impose daily penalties and, with a court order, business disruption measures requiring payment, advertising or internet access providers to stop working with a service or block it in the UK. Senior managers can face criminal liability for certain information and enforcement failures.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- UK Online Safety Act
- User-to-user services (social media, forums, messaging, gaming, dating, file-sharing, etc.), search services, and providers that publish their own pornographic content (Part 5), wherever based, if they have UK links: a significant number of UK users; the UK as a target market (or the only one); or the service can be used in the UK and there is a material risk of significant harm to people in the UK. Some services are exempt (Sch 1 and 2).
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under UK Online Safety Act
- Check whether your service has UK links and falls in scope.
- Complete and record an illegal content risk assessment; redo it before significant changes.
- Apply Ofcom's illegal content codes, including naming an accountable individual.
- Do a children's access assessment; if children are likely users, do a children's risk assessment and apply the child-safety codes.
- Use highly effective age assurance where you host or publish pornography.
- Report detected CSEA content to the NCA (user-to-user services).
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@