Who does this apply to

UK GDPR applies to any organisation that processes the personal data of individuals in the UK, whether that organisation is based in the UK or not, and regardless of size. There is no exemption for small businesses or sole traders; the obligations scale with the risk and volume of the data you handle, not with headcount.

It applies to both controllers and processors, and it covers data processed wholly or partly by automated means (computer systems), as well as some manual filing systems.

There is a limited exemption for purely personal or household activity, such as a private address book, but as soon as data is processed for any business, charity, public sector, or professional purpose, the law applies.