Whilst the UK left the European Union (“EU”) on 31 January 2020 (“Exit Day”) it remained within the EU’s legal framework during the Brexit Transition Period (“Transition Period”). When the Transition Period ends at 11:00 p.m. GMT on 31 December 2020 (“Completion Day”), EU law that was enacted before Exit Day applies in the UK as if it were national law by virtue of Section 3 of the European Union (Withdrawal Agreement) Act 2020 (“Withdrawal Agreement”).
The European General Data Protection Regulation (“EU GDPR“) will be incorporated directly into UK law as the UK GDPR. The UK GDPR will sit alongside an updated version of the Data Protection Act 2018 (“DPA 2018”). The UK GDPR will be substantially the same as the EU GDPR and the key principles, rights and obligations will remain the same, though there is a possibility for future divergence between them. Businesses will need to review their data protection arrangements and ensure they are compliant with the UK GDPR, and continue to be complaint with the EU GDPR if that remains applicable.