Home › Guides › Made in UK

Made in UK hosting: UK GDPR and state surveillance

Since Brexit, the UK has its own GDPR, judged adequate by the EU. But its surveillance regime is among the broadest in Europe. Here is the balance.

Sovereignty rests on two conditions met together: data on the territory and a provider subject to local law.

Estimate my cost →

The legal framework #

The UK GDPR and the Data Protection Act 2018 carry over the essentials of the EU GDPR. The regulator is the ICO. On paper, protection is close to the European standard.

Adequacy, under watch #

The EU granted the UK an adequacy decision, allowing transfers without heavy formalities. It is reviewable and periodically re-examined: a point to watch for a long-term commitment.

The Investigatory Powers Act #

The UK holds extensive surveillance and interception powers (Investigatory Powers Act 2016). That is the counterpoint to know: the data-protection framework is solid, the state-access one is broad.

For whom #

Made in UK fits activities aimed at the British market, or seeking a bridge close to the EU outside the eurozone. For strictly European sovereignty, an EU country stays clearer.

FAQ #

Is the UK still covered by the GDPR?

By the UK GDPR, its national version, very close to the European text. And the EU recognizes it as adequate, which smooths transfers, subject to the review of that decision.

Is data in the UK safe from state access?

No more than elsewhere: the Investigatory Powers Act grants broad access powers. Data protection and state access are two separate matters.

Written on 1 September 2026.