Impact Of Brexit On GDPR

The General Data Protection Regulation (EU) 2016/679 (GDPR) became directly applicable in the UK on 25th May 2018. GDPR in the UK is supplemented by the Data Protection Act 2018 (DPA 2018).

GDPR and DPA 2018 are the two main pieces of legislation that govern the processing of personal data in the UK.

GDPR is, however, EU legislation and accordingly raises the question of how Brexit will impact data protection law in the UK going forward?

Brexit and UK data protection law

The implementation period 

As of 31st January 2020, the UK is no longer an EU member state.

However, there is an implementation period running from 31st January 2020 until 31st December 2020 inclusively.

The Withdrawal Agreement signed by the UK and the EU makes it clear that EU law shall be applicable to the UK during the implementation period. Meaning until 31st December 2020 GDPR will remain the primary legislation in regards to the processing of personal data.

What happens following the implementation period?

At the end of the implementation period, GDPR will be incorporated into the UK’s domestic law and titled ‘UK GDPR’. The necessary changes will also be made to the DPA 2018 in this regard.

UK GDPR

The intention behind the UK GDPR is for the core principles, obligations and rights found within the GDPR to stay the same.

For the time being organisations will need to ensure that they remain compliant with GDPR until 31st December 2020. After 31st December 2020, organisations will need to comply with the UK GDPR, which is likely to be on very similar terms to GDPR.

Accordingly, assuming that organisations have implemented measures to ensure that they are compliant with GDPR/DPA 2018, it is likely that they will have little (if anything) to do to comply with UK GDPR once it is implemented.