Passed by the European Union in April of 2016, the GDPR had far-reaching global impact on data security. No matter where you were based, any organisation that did business with EU citizens had to comply with the GDPR’s expanded and more stringent data protection rules by May 25th, 2018.

The UK voted to leave the EU in 2016 and officially left the trading bloc – its nearest and biggest trading partner – on 31st January 2020. However, both sides agreed to keep many things the same until 31st December 2020, to allow enough time to agree to the terms of a new trade deal.

The GDPR was an EU Regulation and from 1st January 2021 no longer applies to the UK. However, our organisation operates inside the UK, and so we will need to comply with UK data protection law. The GDPR has been incorporated into UK data protection law as the UK GDPR – so in practice, there is little change to the core data protection principles, rights, and obligations found in the EU GDPR. The EU GDPR is an EU Regulation and no longer applies to the UK. We operate inside the UK and need to comply with the Data Protection Act 2018 (DPA 2018).

On 28th June 2021, the EU approved adequacy decisions for the EU GDPR and the Law Enforcement Directive (LED). This means data can continue to flow as it did before in the majority of circumstances. Both decisions are expected to last until 27th June 2025. Most EEA processors will be able to send personal data back to UK controllers with no restrictions.

The EU GDPR may also still apply directly if we operate in the European Economic Area (EEA), offer goods or services to individuals in the EEA, or monitor the behaviour of individuals in the EEA. The ICO will not be the regulator for any European-specific activities caught by the EU version of the GDPR, although they hope to continue working closely with European supervisory authorities.The Data Protection Act 2018 (DPA 2018) continues to apply. The provisions of the EU GDPR were incorporated directly into UK law at the end of the transition period. The UK GDPR sits alongside the DPA 2018 with some technical amendments so that it works in a UK-only context.

The ICO will remain the independent supervisory body regarding the UK’s data protection legislation. The UK government will continue to work towards maintaining close working relationships between the ICO and other countries’ supervisory authorities once the transition period ends. The principles of the EU GDPR have been incorporated in UK Data Protection law, so we will continue to use our existing policies and procedures. We have updated this policy and procedure to reflect that the Brexit transition period has ended. We will continue to keep our policies under review and update them where necessary.

The Guide to the UK GDPR is part of the ICO’s Guide to Data Protection. It is for DPOs and others who have day-to-day responsibility for data protection. It explains the general data protection regime that applies to most UK businesses and organisations. It covers the UK General Data Protection Regulation (UK GDPR), tailored by the Data Protection Act 2018. It explains each of the data protection principles, rights, and obligations and summarises the key points which are contained in this policy and procedure. Where relevant, this guide also links to more detailed guidance and other resources, including ICO guidance and statutory ICO codes of practice. Links to relevant guidance published by the European Data Protection Board (EDPB) are also included for reference purposes.