UK GDPR for app startups: what applies when you sell to people in the UK

Does UK GDPR apply to a company based in India or the UAE?

It can. The ICO describes three situations: an establishment in the UK; 'targeting', where an organisation outside the UK offers goods or services to people in the UK or monitors their behaviour; and places where UK law applies under public international law, such as a UK-registered ship. For a startup abroad, targeting is the usual trigger, and UK GDPR then applies to the processing related to that targeting. If none of the three applies, the ICO says it has no jurisdiction.

Do we need a UK representative?

Generally yes, if you have no UK establishment but target people in the UK. The ICO says organisations in that position 'generally need to appoint someone to act as their representative in the UK', with an exemption for public authorities and for occasional, low-risk processing. The representative is a point of contact for individuals and the ICO and acts as your agent; it is not a controller or processor, and enforcement is still directed at you.

How fast must a breach be reported to the ICO?

'You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it.' A breach that is unlikely to result in a risk to people's rights and freedoms need not be reported, but you must document why. If the breach is likely to cause a high risk, you must also tell the people affected without undue delay, and you should record every breach whether or not it is reported.

What does an erasure request require, including backups?

You must respond 'without undue delay and at the latest within one month', extendable by two further months only for complex requests, and you must tell the person within the first month if you extend. Requests can be made verbally or in writing.

Erasure reaches backups too. The ICO says the key issue is to put backup data 'beyond use', even if it cannot be overwritten immediately; it may stay until overwritten on your normal schedule as long as it is not used. If you disclosed the data to others, you must tell each recipient about the erasure unless that is impossible or needs disproportionate effort.

What changed with the Data (Use and Access) Act 2025?

Most of the Act's remaining data protection provisions came into force on 5 February 2026, and the complaints requirement followed on 19 June 2026. The ICO says all organisations 'must now give people a clear way to raise a data protection complaint', must acknowledge complaints within 30 days, investigate appropriately and tell the person the outcome.

The Act also gave the ICO the power to fine up to £17.5 million or 4% of global turnover under the Privacy and Electronic Communications Regulations (PECR), the rules that govern cookies and electronic marketing.

Can a UK website or app use analytics cookies without consent?

Under PECR as amended, the ICO lists five exceptions to consent for storage and access technologies: communication, strictly necessary, statistical purposes, appearance, and emergency assistance. The statistical exception covers storage or access 'for the sole purpose of collecting statistical information about visitors to your service, with a view to improving it'.

It comes with conditions: users get clear and comprehensive information about the purpose, a 'simple and free' means to object, and the data is used only to improve your service or website. Uses outside the exceptions still need consent.

What if children are likely to use the app?

The ICO's Children's code (the Age appropriate design code) applies to 'relevant information society services which are likely to be accessed by children', meaning under-18s, including services not aimed at children if children are more likely than not to use them. Apps, games, social media and educational sites are examples. It can apply to services based outside the UK that offer services to UK users or monitor them.