Whilst the UK left the European Union (“EU”) on January 31, 2020 (“Exit Day”) it remained within the EU’s legal framework during the Brexit Transition Period (“Transition Period”). When the Transition Period ended at 11:00 p.m. GMT on December 31, 2020 (“Completion Day”), EU law that was enacted before Exit Day applied in the UK as if it were national law by virtue of Section 3 of the European Union (Withdrawal Agreement) Act 2020.
The European General Data Protection Regulation (“EU GDPR”) will be incorporated directly into UK law as the UK GDPR. The UK GDPR will sit alongside an updated version of the Data Protection Act 2018. The UK GDPR will be substantially the same as the EU GDPR and the key principles, rights and obligations will remain the same, though there is a possibility for future divergence between them. Businesses will need to review their data protection arrangements and ensure they are compliant with the UK GDPR, and continue to be complaint with the EU GDPR if that remains applicable.
The European Data Protection Board has recently issued a statement on the main implications of the end of the Transition Period for controllers and processors, and the UK Information Commissioner’s Office has published guidance on the data protection implications.
For further information on data protection after the Brexit transition period, click here.
Source: www.lawsociety.org.uk