The UK GDPR is the retained EU law version of the General Data Protection Regulation (GDPR) as it forms part of the law of England and Wales, Scotland, and Northern Ireland, and is implemented through the Data Protection Act 2018.

To reference the Data Protection Act 2018:

Full reference

Data Protection Act 2018, c.12. Available at: https://www.legislation.gov.uk/ukpga/2018/12/contents (Accessed: 20 March 2025).

In-text citation:

e.g.  The Data Protection Act 2018 sets out the UK GDPR....

To reference the UK GDPR:

Full reference

Council regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation)(Text with EEA relevance).  Available at: https://www.legislation.gov.uk/eur/2016/679 (Accessed: 20 March 2025).

In-text citation

e.g. According to the UK GDPR (Council directive 2016/679 [2018])...

When the UK left the EU, legislation.gov.uk published EU legislation that had been published by the EU up to IP completion day. On legislation.gov.uk, these items of legislation are kept up-to-date with any amendments made by the UK since then. Retained direct EU legislation uses the same titles and citations as the EU original. In some instances a UK-specific title for the retained version has been adopted via legislation (e.g., UK GDPR), simply for the purposes of clarity. Where a specific UK title is adopted, the full references for the EU and retained EU versions are different, but the bulk of the title and citations remain the same.