I will say it depends on where the business responsible for the site is based on. A few month ago I run into troubles with a well known Third party advertisement service (not Google) and for you to have an idea the Data Protection Commissioner (Information Commissioner's Office) could not reach them or even demand them to hand over certain information simply because in their T&C they state that any legal proceeding should be carried on the country from where they are based.
They are not required to comply with local or EU laws, but yes they can operate an .ie or in your case an .co.uk domain name, they can even host the site in your country, the thing is where they are based.
There is a massive gap due to the fact that the ones writing these rules don't know how to send an email... Today, a business can be registered in India (due to low tax) have a website hosted in US (good price) and operate a .co.uk domain name (their target audience).
"An organisation based in the UK is likely to be subject to the
requirements of the Regulations even if their website is technically
The "based" is too vague and poor, based as in registered business ? Hosted ? Domain name ? Target audience ?
All this without thinking that instead of a .co.uk you can operate a .com that is just targeted for people in the UK.
In my opinion IF you have a .co.uk and you are "based" on the UK (as in living there) you should follow the laws just because is easy to find out who owns the domain name, and maybe where is hosted.
IF the site under a .co.uk, is hosted outside AND they can't find where you are "based" (as in you are not living there) You can avoid to comply with these rules.
The fine can be a maximum of 500,000£ IF you know that you where doing something wrong and the level of the wrong dong was such that was causing distress among your users.
• Monetary penalty notice: a monetary penalty notice requires an
organisation to pay a monetary penalty of an amount determined by the
ICO, up to a maximum of £500,000. This power can be used in the most
serious of cases and if specific criteria are met, if any person has
seriously contravened the Regulations and if the contravention was of
a kind likely to cause substantial damage or substantial distress. In
addition the contravention must either have been deliberate or the
person must have known or ought to have known that there was a risk
that a contravention would occur and failed to take reasonable steps
to prevent it.
In my own experience the website was not accountable because was and I quote "... outside of EU jurisdiction..."