22 October 2026
One UK GDPR, Four Nations: Why one size doesn’t fit all
By Alison Sigsworth, Information Governance Manager
England, Wales, Scotland and Northern Ireland are all part of the United Kingdom, but organisations across the four nations may put data protection requirements into practice in different ways. Those differences matter because effective compliance needs to work in the real world, not just on paper!
In September 2026, the Information Commission’s Office (ICO) approved the Wales Accord on the Sharing of Personal Information (WASPI) UK GDPR Code of Conduct for Information Sharing Protocols (I know it’s a mouthful!).
The Code provides a structured approach to lawful, transparent, and accountable information sharing, particularly for organisations in the health, education, social care, safeguarding and other public sectors in Wales.
Its requirements include using an approved Information Sharing Protocol template, alongside governance controls, quality assurance, accountability measures, regular reviews, and ongoing monitoring.
Of course, that doesn’t mean Wales has its own version of the UK GDPR. Instead, it shows how the same legal principles can be applied in a way that suits the Welsh context.
Organisations everywhere can learn from that approach.
Forget ‘one size fits all’
Just as one size doesn’t fit all of the UK, it doesn’t fit every organisation either.
Two organisations working in the same sector can have very different needs. They might serve different demographics, have different organisational priorities, or use different systems and services. Their governance structures, resources, and experience of handling personal data may differ considerably. Most importantly, organisations can have different risk appetites which will shape the controls they choose, the decisions they make, and the level of assurance they want.
Simply adopting a similar organisation’s policies, retention schedules, templates, or procedures might not always deliver the best outcome. On the other hand, applying one standard solution across a group of diverse clients can overlook the circumstances that should influence how data protection compliance works in practice.
The UK GDPR itself reflects this risk-based approach. The nature, scope, context, purpose and the risks to individuals, are all things that need to be considered when processing personal data.
The approach that Wales has taken therefore provides a useful model; start with consistent principles, then develop practical approaches that reflect the environment in which they will work.
The same principles, tailored to you
At Naomi Korn Associates, we begin by understanding your organisation rather than assuming that the same solution will work everywhere. We help you identify the legal and regulatory requirements that provide the common foundation, explore how they interact with your risks, people and priorities, and turn them into practical governance arrangements that work for you.
This can include reviewing policies and procedures, assessing information sharing arrangements, identifying gaps and risks, developing governance frameworks, providing training, and helping teams understand what good practice means for your organisation.
The destination may be the same, but the best route to compliance will not always be. We can help you find the route that works for you.
Are you looking to improve your organisation’s approach to data sharing and processor agreements? Our CPD-accredited, half-day Information Sharing, Data Processors and Contracts course provides a practical guide to understanding Data Sharing Agreements and Data Processing Addendums. You’ll explore the critical roles and responsibilities of Data Controllers and Data Processors, and work through real-world examples to understand the necessary steps and legal considerations when sharing data. The course is available to arrange throughout the year online or in person for your organisation – see our In House training page or reach out to us at info@naomikorn.com for further information.