GDPR, Brexit and data protection
Whereas the General Data Protection Regulation (GDPR) should be applicable in the UE from May 2018, BREXIT could lead to a new fragmentation of the European rules regarding data protection. If the GDPR focused on building and improving a European Data market, any Brexit could harm this goal and have undesirable consequences.
Furthermore, being outside of the European Union won’t prevent British companies from enforcing the GDPR regarding its provisions on territorial scope (article 3) but will generate new forms of legal complexity.
Brexit and GDPR
Like in many other contexts, some solutions are at stake: an “UE-UK Privacy Shield” or an adequacy decision could then be negotiated, even if such political processes imply much time. In the absence of any transitional mechanism, UK companies may face legal complexity when addressing the internal market.
Such difficulties should be considered as additional grounds for mapping all flows of datas concerned (for example when datas are stored or transferred to/from the UK). And they must underline all the necessary steps to be fully compliant with the GDPR.