September 28th, 2026 at 03:33 pm
By Ronak Shah, Nordstone | Last updated: September 2026
Yes: UK GDPR applies to almost every app that handles personal data about people in the UK, including emails, device identifiers and analytics. You need a lawful basis, must collect only what you need, tell users clearly, protect the data, honour their rights, run a DPIA for high-risk processing, and report serious breaches within 72 hours.
| TL;DR • Does it apply? Yes, in almost every case. If your app handles personal data about people in the UK, UK GDPR applies, wherever you are based. • Core principles: be lawful, fair and transparent, use data only for stated purposes, collect the minimum, keep it accurate and secure, delete it when done, and be able to prove it. • Consent and SDKs: advertising and tracking SDKs still need prior consent. Since 5 February 2026, certain first-party analytics are exempt if users are informed and can opt out. • User rights and DPIAs: answer access, deletion and portability requests within one month, and run a DPIA before launching high-risk features such as AI, location tracking or children’s services. • Penalties: up to £17.5 million or 4% of global turnover. The ICO fined Reddit £14.47 million in February 2026, partly for skipping a DPIA. • Before launch: map your data, choose lawful bases, audit SDKs, publish a privacy notice, build rights tools, sign processor contracts and plan for breaches. |
This guide is general information, not legal advice. For decisions with real legal risk, speak to a data protection lawyer or your Data Protection Officer.
Does UK GDPR apply to your app?
Almost always, yes. UK GDPR applies if you are established in the UK, or if you offer your app to people in the UK or monitor their behaviour, even if your company is based abroad. It is set out in the UK GDPR, the Data Protection Act 2018 and, for cookies, device access and electronic marketing, the Privacy and Electronic Communications Regulations (PECR). The Data (Use and Access) Act 2025 (DUAA) amends these rules rather than replacing them, with the main provisions in force since 5 February 2026, according to commencement guidance from law firm RPC.
The definition of personal data is wider than most founders expect. An email address obviously counts, but so do device identifiers, advertising IDs, IP addresses, precise location, push tokens and usage logs that can be linked to one person. Even an app with no sign-up usually collects some of these. The main exceptions are purely personal or household use and data that has been genuinely anonymised, which is harder to achieve than simply removing a name.
It also helps to know your role. If you decide why and how users’ data is used, you are the controller and carry primary responsibility. Suppliers who process data on your instructions, such as cloud hosts and development agencies, are usually processors, and you need a written contract with them. Most UK controllers must also pay the ICO’s data protection fee unless an exemption applies.
The core data-protection principles for apps
UK GDPR rests on seven principles in Article 5, and each translates into a design decision. In plain English: be lawful, fair and transparent, meaning users should never be surprised by what your app does with their data, and your privacy notice should say it in language they can follow. Use data only for the specific purposes you stated at the start, so a fitness tracker cannot quietly hand workout data to advertisers.
Collect only what you need for those purposes (data minimisation), keep it accurate and up to date, and do not hold it for longer than necessary (storage limitation). Protect it with appropriate security, such as encryption and access controls (integrity and confidentiality). Finally, the accountability principle means you must be able to demonstrate compliance, so keep records of your decisions, assessments and contracts. Our team applies these at the scoping stage of every build; see how that fits into our mobile app development process.
Lawful basis and consent
Every use of personal data needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. For most apps, “contract” covers what you need to deliver the service, such as an account and order history. “Legitimate interests” can cover things like fraud prevention if you document a balancing test. The DUAA added a list of “recognised legitimate interests”, such as crime prevention and safeguarding, which need no balancing test, but routine marketing and analytics are not among them.
Consent is the right basis when users have a real choice, for example optional marketing or personalised advertising. It must be freely given, specific, informed and unambiguous, separate from your terms and conditions, and as easy to withdraw as to give. Pre-ticked boxes and “accept all” screens without a fair “reject” option do not meet the standard.
Cookies, tracking and third-party SDKs
Under PECR, storing or accessing information on a user’s device generally needs consent, and that includes apps and SDKs reading device or advertising identifiers, not only website cookies. Strictly necessary technologies remain exempt. From 5 February 2026, the DUAA also exempts certain low-risk technologies, such as some first-party analytics and functionality settings, provided users are told about them and can easily object, as summarised by Clifford Chance and Bratby Law. Advertising and cross-site tracking still require prior consent.
The stakes are higher too. PECR fines now align with UK GDPR, at up to £17.5 million or 4% of global annual turnover. The most common failure we see in app audits is an SDK that starts sending data at first launch, before the user has answered any consent prompt. List every SDK, record what it collects and where it sends it, and configure non-essential ones to stay dormant until consent is given. Make sure your App Store and Google Play privacy declarations match what the code actually does.
If children might use your app, add another layer. The ICO’s Children’s Code expects high-privacy defaults and age-appropriate design, and self-declared birthdays are not considered a robust age check.
Data minimisation and storage
The safest data is the data you never collect. For each field in your sign-up flow, ask what feature breaks without it. Ask for approximate location instead of precise location if that is enough, use pseudonymous IDs in analytics, and avoid collecting dates of birth when an age-range check will do. Every extra field is something you must secure, disclose, explain and eventually delete.
Set a retention schedule before launch. Decide how long you keep account data after inactivity, how long logs and backups live, and how deletion cascades through your database, analytics tools and third-party services. Encrypt data in transit and at rest, restrict staff access, and keep an audit trail. Check where your cloud provider and vendors process data: transfers outside the UK need a valid mechanism, such as adequacy regulations or the ICO’s international data transfer agreement or addendum. Finally, have a breach plan, because serious breaches must be reported to the ICO within 72 hours of you becoming aware of them. See our AI and machine learning app development work for how these controls apply to data-hungry features.
User rights in your app
UK GDPR gives people a set of rights, and users increasingly expect to exercise them inside the app itself. Most requests must be answered within one month. The DUAA clarified that you need only carry out a reasonable and proportionate search for access requests, and that you can refuse requests that are “vexatious or excessive”. The table shows the main rights and what they look like in practice.
| Right | What it means | How to support it in your app | Deadline |
| Access | A copy of the personal data you hold and details of how it is used | A “download my data” or request form in account settings; verified identity check | One month |
| Rectification | Correct inaccurate or incomplete data | Editable profile fields; support route for data you cannot edit | One month |
| Erasure | Deletion of data in certain circumstances, such as consent withdrawn | A “delete my account” button that also deletes from analytics, backups (on schedule) and processors | One month |
| Portability | Data provided by the user, in a structured, commonly used, machine-readable format | Export to CSV or JSON for data based on consent or contract | One month |
| Objection | Stop processing based on legitimate interests; absolute right to stop direct marketing | Marketing toggles; opt-out for analytics; clear unsubscribe | Without undue delay |
| Automated decisions | Safeguards where significant decisions are made by automated means | Human review option and explanation, especially for AI features | Per request |
Sources for the table: UK GDPR Articles 12 to 22, as amended by the Data (Use and Access) Act 2025; ICO guidance on individual rights.
One newer duty catches small teams out. Since 19 June 2026, organisations must offer an electronic way for people to complain about how their data is handled, acknowledge complaints within 30 days and respond without undue delay, per the same RPC commencement summary. A simple form and an owner for the inbox is enough to start. Do you need a DPIA?
A Data Protection Impact Assessment is required before you start any processing that is likely to result in a high risk to people. The ICO’s guidance points to triggers that are common in apps: using innovative technology such as AI, large-scale profiling, tracking location or behaviour, processing sensitive data such as health information, matching datasets from different sources, and offering online services to children. If your app does any of these, treat a DPIA as mandatory.
A DPIA is a short, structured document. It describes what you will do with the data, tests whether it is necessary and proportionate, identifies the risks to users, and records how you will reduce them. If serious risk remains after mitigation, you must consult the ICO before proceeding. Do it during design, not after launch, because the answers can change what you build. Even for lower-risk apps, a brief DPIA is a sound way to show accountability.
The penalties for getting it wrong
The higher maximum fine under UK GDPR is £17.5 million or 4% of global annual turnover, whichever is greater, and the standard maximum is £8.7 million or 2%. Since the DUAA came into force, PECR breaches such as unlawful tracking or marketing carry the same ceiling, up from £500,000. Fines are not the only consequence. The ICO can issue reprimands and enforcement notices, and users can claim compensation. Loss of trust, app-store scrutiny and investor due diligence problems often cost more.
A recent UK enforcement example
On 24 February 2026, the ICO fined Reddit £14.47 million for using children’s personal information unlawfully. According to law firm Willkie’s summary, investigators found Reddit had no age checks until July 2025 and had not carried out a DPIA covering risks to children before January 2025, despite its terms banning under-13s. Osborne Clarke reports that the ICO warned self-declaration is not enough, and that Reddit is reported to plan an appeal. The lesson for founders is simple: a policy on paper is not compliance. The ICO looked at what the product actually did.
Pre-launch GDPR checklist
Work through this list before you submit to the App Store or Google Play. Tick each item only when you can show evidence for it.
☐ Map every category of personal data your app collects, why, where it is stored and who receives it.
☐ Record a lawful basis for each purpose, and separate consent from your terms and conditions.
☐ Audit every third-party SDK and disable non-essential ones until the user consents.
☐ Publish a clear, plain-English privacy notice, linked in the app and in the store listings.
☐ Align App Store privacy labels and Google Play data safety answers with what the code does.
☐ Collect only necessary fields and set a written retention schedule, including logs and backups.
☐ Encrypt data in transit and at rest, and restrict staff access to production data.
☐ Sign written processor contracts with hosting, analytics and other suppliers.
☐ Confirm international transfers use a valid UK mechanism.
☐ Build in-app tools for access, correction, export, deletion and marketing opt-out.
☐ Set up a complaints form and an owner, and a process to meet the one-month deadline.
☐ Complete a DPIA if you use AI, location, sensitive data, profiling or serve children.
☐ Add age assurance and child-friendly defaults if under-18s are likely to use the app.
☐ Write a breach response plan able to meet the 72-hour ICO reporting deadline.
☐ Pay the ICO data protection fee, unless you are exempt.
Frequently asked questions
Does UK GDPR apply to my app?
What do I need to be GDPR compliant?
Do I need consent for analytics and tracking?
What is a DPIA and do I need one?
What are the fines for breaching UK GDPR?
Do third-party SDKs affect my compliance?
Do I need to let users delete their data?
Who is responsible — me or my developer?
Get a GDPR readiness review
Compliance is far cheaper to design in than to retrofit. Nordstone builds apps with privacy considered from the first sprint, including data mapping, SDK selection, consent flows and in-app rights tools. If you would like a second pair of eyes on your product before launch, request a GDPR readiness review and we will walk through your data flows with you.
