EU GDPR: the regulation, the UK divergence and DOCNUS's EU rule pack

The EU General Data Protection Regulation, Regulation (EU) 2016/679, applies across the European Union. Its official text is published on EUR-Lex. For years the UK and EU versions were almost identical. That is no longer true, and if your organisation handles personal data about people in both, the differences now matter.

This page covers the EU text, where it now differs from the UK version, the status of UK adequacy, and what DOCNUS assesses under its EU GDPR rule pack.

The core definitions

The EU GDPR defines personal data as any information relating to an identified or identifiable natural person. Identification can be direct or indirect, through things like a name, an identification number, location data or an online identifier. Our what is PII page explains why this is broader than the US idea of personally identifiable information.

Two groups of data get stricter treatment:

• Special categories (Article 9(1)): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a person, health data, and sex life or sexual orientation. Processing needs a condition under Article 9(2). See special category data.
• Criminal offence data (Article 10): data about criminal convictions and offences or related security measures, processed only under official authority or where authorised by law.

The regulation also defines pseudonymisation in Article 4(5). Pseudonymised data is still personal data. See pseudonymisation.

How the EU GDPR and UK GDPR now differ

The UK's Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, and most of its data protection changes took effect on 5 February 2026. The EU GDPR has had no equivalent changes. The UK government lists the DUAA data protection changes.

If you work under both regimes, check which one applies to each processing activity rather than assuming the UK rules match the EU rules. The UK GDPR page covers the UK changes in more depth.

UK adequacy: renewed to 2031

Despite the divergence, the European Commission renewed its adequacy decision for the UK on 19 December 2025. It runs until 27 December 2031, so the EU continues to recognise the UK as providing adequate protection despite the DUAA changes. The Commission keeps a list of adequacy decisions, and the European Data Protection Board published its opinions on the draft UK decisions.

What DOCNUS's EU GDPR pack cites

The privacy assessment, available on Professional and Enterprise plans, evaluates EU GDPR as a separate rule pack from UK GDPR. The AI model and deterministic detectors only report what is in the document. The verdict is decided by code from the versioned pack, which we explain in AI finds facts, code decides law.

The verdict levels are not in scope, compliant / low risk, attention required, and non-compliant / high risk, with a risk score from 0 to 100. Obligations surfaced include:

• Data protection impact assessment, Art. 35(3)
• Transparency, Art. 13 and 14
• Storage limitation, Art. 5(1)(e)
• International transfers, Chapter V
• The subject access deadline, Art. 12(3)

DOCNUS decides whether EU GDPR applies to a document from jurisdiction signals in it. Where the signal is weak, the law is shown as "possible" and not evaluated. Where several laws apply, the document gets the strictest verdict and shows which law drove it. Besides EU and UK GDPR, the packs cover California CCPA/CPRA, a US state baseline modelled on Virginia's VCDPA, Brazil LGPD, China PIPL and India DPDP.

Scope and limits

• The assessment is automated and is not legal advice. Every result says so.
• It does not assess your lawful basis, your legitimate interests balancing, or whether a transfer mechanism is in place.
• It does not make you compliant with the EU GDPR. It shows where personal data is and which rules are likely to apply.
• Detection can miss things or flag things wrongly, so review results against the cited pages.
• Assessment covers up to 100 pages per document; longer documents are marked "partial".

One more point that matters for EU users: DOCNUS uses subprocessors that process data in the US, as listed in our privacy policy. Findings are stored as masked values, not raw values. See security for details.