Brexit—implications for data protection
Brexit—implications for data protection

The following IP guidance note provides comprehensive and up to date legal information covering:

  • Brexit—implications for data protection
  • Overview of Brexit
  • Withdrawal Agreement and implementation period
  • Post-implementation period: The one-stop-shop and oversight by a lead supervisory authority
  • Post-implementation period: International transfers
  • Post-implementation period: Compliance with UK and EU GDPR regimes
  • Post-implementation period: Appointment of local representatives
  • Post-implementation period: Data protection officers
  • Post-implementation period: Documentation and records of processing
  • Post-implementation period: Transparency
  • more

This Practice Note discusses the impact of Brexit on the general processing of personal data under the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), which became directly applicable in the UK and all other EU Member States on 25 May 2018 and which has governed the processing of personal data across the EEA (the EU plus Iceland, Norway, and Liechtenstein), since its incorporation into the EEA Agreement.

In the UK, the adoption of the GDPR into UK law was assisted and supplemented by the Data Protection Act 2018 (DPA 2018) which provides permitted national derogations/exceptions to the requirements of the GDPR, see Practice Note: The Data Protection Act 2018.

For a comprehensive introduction to the GDPR, collating key practical guidance, see: GDPR toolkit.

This Practice Note does not address the processing of personal data by competent authorities for law enforcement purposes or by the intelligence services, and under the ‘applied GDPR’ regime, which are beyond the scope of this guidance. For guidance on the impact of Brexit on the processing of personal data by competent authorities for law enforcement purposes, see Practice Note: Processing personal data by law enforcement and intelligence agencies—an introduction to the Data Protection and Law Enforcement Directive and Part 3 of the Data Protection Act 2018—Impact of Brexit.

Overview of Brexit

As of exit day (31 January 2020)