Abstract
UK GDPR incorporates EU GDPR into UK law following Brexit. It provides substantially similar protections including rights of access, erasure, and data portability. The ICO (Information Commissioner’s Office) supervises compliance. The UK benefits from EU adequacy, enabling free data flows between UK and EU.
Summary
Following Brexit, the UK retained GDPR through the European Union (Withdrawal) Act, creating ‘UK GDPR’. Combined with the Data Protection Act 2018, this forms UK data protection law. UK GDPR mirrors EU GDPR with modifications: references to EU institutions replaced with UK equivalents, the ICO as supervisory authority, and national security exemptions reflecting UK law. The EU granted the UK adequacy status in 2021, allowing data to flow freely between EU/EEA and UK without additional safeguards. However, this adequacy is reviewed periodically and could be revoked if UK law diverges significantly from EU standards. The tension between UK GDPR’s protections and the broad surveillance powers under the Investigatory Powers Act remains a concern for EU adequacy assessments.
No additional commentary yet. Contribute on GitHub.