There is no denying that Brexit will have implications for data protection and the ongoing flow of personal data from the European Union (EU) to the UK (United Kingdom). Currently governed by the EU General Data Protection Regulation (GDPR) as applied by the UK’s Data Protection Act (DPA), if the UK leaves the EU in March, all regulations will remain in place and the European Union (Withdraw) Act 2018 will incorporate the GDPR into UK law. In a May 2018 proposal for a post-Brexit data agreement, the UK is seeking a legally binding agreement to allow for EU-UK data flows that cannot be changed unilaterally by the EU. In September, the UK Government also published a technical notice, “Data protection if there’s no Brexit deal,” which sets out the actions UK organisations are recommended to take to enable the continued flow of personal data between the EU and the UK in the event that the UK leaves the EU with no exit agreement in place.
