UK GDPR + PECR (Data (Use and Access) Act 2025)

It can. The UK GDPR applies to businesses outside the UK that process personal data of people in the UK when they offer goods or services to them or monitor their behavior in the UK (Article 3(2)). Such businesses must name a representative in the UK in writing, unless the processing is occasional, involves no large-scale sensitive or criminal data, and is unlikely to put people’s rights at risk (Article 27).

The cookie rule is in PECR regulation 6. The Data (Use and Access) Act 2025 rewrote it, and since February 5, 2026 there are new exceptions to consent. Consent is still needed unless an exception applies:

• Strictly necessary for the service the visitor asked for, including security and fraud prevention.
• Analytics: only to collect statistics about how your service is used, with clear information and a simple, free way to object. The ICO says the analytics provider must act as your processor, not a joint controller.
• Appearance and functionality: only to make the site look or work the way the visitor chose, again with information and a free way to object.

The ICO is clear that advertising cookies still need consent: “Online advertising purposes are not exempt from PECR’s consent requirements and never have been.”

Answer rights requests within one month, extendable by two further months for complex or numerous requests with reasons given in the first month. The clock starts when you have what you reasonably need to identify the person. Searches for access requests need only be reasonable and proportionate.

Since June 19, 2026, every controller must have a way to make data protection complaints, such as a form that can be filled in online, must acknowledge complaints within 30 days, and must respond without undue delay.

Since February 5, 2026, breaches of the PECR cookie rules carry the UK GDPR’s higher maximum: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The cap had been £500,000.

The regulator reviewed the UK’s top 1,000 websites; by April 2026 it reported that 99% met its cookie banner standards. Its one published cookie sanction so far is a 2024 reprimand to Sky Betting and Gaming for setting advertising cookies without consent. On September 30, 2026 the Information Commissioner’s Office became the Information Commission; it still goes by ICO.