Skip to content
FaceSearch Wiki
Try it

Law · United Kingdom

UK GDPR and the Data Protection Act 2018

After Brexit the United Kingdom kept the GDPR as domestic law, the UK GDPR, supplemented by the Data Protection Act 2018 and enforced by the Information Commissioner's Office. Biometric data used to identify a person is special category data requiring a lawful basis and a specific condition. The framework was tested against Clearview AI in a case that ran from a 2022 fine to the Upper Tribunal in 2025 and on to the Court of Appeal.

Updated November 6, 2026 · 3 min read · reviewed November 6, 2026

  1. 2018-05-25

    GDPR and Data Protection Act 2018 apply

    The DPA 2018 fills in the UK's choices, including biometric conditions in Schedule 1.

  2. 2021-01-01

    UK GDPR

    The EU text is frozen into UK law at the end of the Brexit transition.

  3. 2022-05-23

    ICO fines Clearview AI

    7.5 million pounds and an enforcement notice to delete UK residents' data.

  4. 2023-10-17

    First-tier Tribunal

    Clearview wins: its processing for foreign law enforcement clients was outside the UK GDPR's scope.

  5. 2025-10-07

    Upper Tribunal

    The ICO's appeal succeeds on three of four grounds; the case is sent back to the First-tier Tribunal.

  6. 2025-12

    Permission to appeal

    Clearview is given leave to take the scope question to the Court of Appeal.

What does UK law say about faces?

The UK GDPR carries the EU definitions: biometric data (Article 4(14)) is personal data from specific technical processing that allows unique identification, and processing it to identify someone is prohibited by Article 9 unless a condition applies. The Data Protection Act 2018 supplies the UK-specific conditions in Schedule 1, such as substantial public interest conditions for preventing fraud or supporting equal opportunities. The ICO's 2024 guidance on biometric recognition sets out that a face template is special category data whether or not the system ever names anyone, and that explicit consent is the usual condition for commercial use.

Who enforces it?

The ICO investigates, issues information, assessment and enforcement notices, and imposes monetary penalties. Individuals can complain to the ICO, sue for compensation, and exercise access, erasure and objection rights directly against a controller. The Data (Use and Access) Act 2025 restructures the ICO into an Information Commission with a board, raises PECR fines to UK GDPR levels and makes several process changes, with commencement through 2025 and 2026.

What happened with Clearview AI?

ICO v Clearview AI, 2022 to 2026
StageOutcome
May 2022, ICO monetary penalty and enforcement notice7.5 million pound fine; order to stop collecting and to delete UK residents' images
October 2023, First-tier TribunalAppeal allowed: processing was by foreign law enforcement clients, outside UK GDPR territorial scope
October 2025, Upper TribunalICO's appeal allowed on three grounds; Clearview's processing 'relates to monitoring' UK residents; remitted to the First-tier Tribunal
December 2025, permission to appealClearview may take the material-scope point to the Court of Appeal; hearing reported in 2026
The fine has not been paid while the proceedings continue.

What does it mean for face search?

The ICO v Clearview litigation is about territorial and material scope, not about whether scraping faces is lawful; the ICO's substantive finding, that it is not, has not been overturned. An engine that serves UK users, or that monitors UK residents by indexing their faces, is within the UK GDPR on the Upper Tribunal's reasoning, whether it is Clearview, PimEyes, FaceCheck.ID or FaceSearch. A UK resident can use Articles 15 and 17 to demand access and erasure, complain to the ICO if ignored, and sue for distress. Searching your own face is a use of the service, not the processing the ICO has objected to.

What is pending or unsettled?

  • The Court of Appeal's decision on whether Clearview's processing is within the material scope of the UK GDPR; the Upper Tribunal held that it is.
  • Commencement of the remaining Data (Use and Access) Act 2025 provisions, including the 'recognised legitimate interests' basis and changes to automated decision-making rules.
  • The ICO's stated enforcement priority for biometric technologies in its 2025 to 2026 plan, including a facial recognition in retail investigation.

Questions

Is a face template special category data in the UK?

Yes. The ICO's biometric guidance treats a face template used for recognition as biometric data under Article 9, requiring a lawful basis and a specific condition such as explicit consent.

Did Clearview win in the UK?

It won at the First-tier Tribunal in 2023 on scope. The Upper Tribunal reversed that in October 2025 and sent the case back; Clearview has permission to appeal further. The ICO's fine stands on paper but is unpaid.

Can I ask a face search engine to delete my data under UK law?

Yes, under Articles 15 and 17 of the UK GDPR. If a request is ignored, complain to the ICO or bring a claim.

What changed with the Data (Use and Access) Act 2025?

It reorganises the ICO, adds recognised legitimate interests, adjusts rules on automated decisions and cookies, and created the deepfake creation offence that came into force in February 2026. Biometric rules were not loosened.

Sources

  1. 1.legislation.gov.uk, Data Protection Act 2018 (checked November 6, 2026)
  2. 2.ICO, Biometric data guidance: biometric recognition (February 2024) (checked November 6, 2026)
  3. 3.ICO, UK Upper Tribunal hands down judgment on Clearview AI Inc (8 October 2025) (checked November 6, 2026)
  4. 4.legislation.gov.uk, Data (Use and Access) Act 2025 (checked November 6, 2026)

Entry reviewed November 6, 2026. Found an error? Tell us.

Related entries

Cite this entry

FaceSearch Wiki editors. "UK GDPR and the Data Protection Act 2018". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/uk-gdpr-and-dpa-2018/