The Information Commissioner’s Office (ICO) has published a statement confirming that following the UK’s decision to leave the EU, the General Data Protection Regulation (GDPR) will not directly apply to the UK but if the UK wants to trade with the Single Market on equal terms, it would have to prove “adequacy” by May 2018.
The ICO will be speaking with the government to confirm that reform of UK data protection law remains necessary.
It is too early to say what form the UK’s adequacy might take, but the ICO has been clear throughout the referendum process that businesses should continue to make arrangements to comply with the GDPR, even in the event of a Brexit. Businesses will have to await further communications from the ICO as to the extent this will still be necessary.
Please note that the above does not constitute legal advice.