GENERAL DATA PROTECTION REGULATION AND DATA PROTECTION ACT 2018


Brexit legislation:

  • The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, SI 2019/419. The Explanatory note attached to the Regulations states as follows:
    'Regulations 1 and 2 cover citation, commencement, extent and interpretation.
    Regulation 3 introduces Schedule 1, which amends Regulation (EU) 2016/679 of the European Parliament and of the Council (“the GDPR”) as it forms part of domestic law by virtue of section 3 of the EUWA 2018.
    Regulation 4 introduces Schedule 2, which amends the DPA 2018. Among other things, changes made by Schedules 1 and 2 have the effect of merging two pre-existing regimes for the regulation of the processing of personal data – namely that established by the GDPR as supplemented by Chapter 2 of Part 2 of the DPA 2018 as originally enacted, and that established in Chapter 3 of Part 2 of the DPA 2018 as originally enacted (“the applied GDPR”). The applied GDPR extended GDPR standards to certain processing out of scope of EU law and the GDPR.
    Regulation 5 makes provision concerning interpretation in relation to processing that prior to exit day was subject to the applied GDPR.
    Regulation 6 introduces Schedule 3, which makes amendments to other legislation. Part 1 of Schedule 3 revokes certain EU data protection law that forms part of domestic law by virtue of section 3 of the EUWA 2018. Parts 2 and 3 of Schedule 3 make amendments to other legislation consequential to the amendments made in Schedules 1 and 2. Part 4 of Schedule 3 makes general provision for references to the GDPR (that are not otherwise amended by Parts 2 or 3) to have effect as references to the UK GDPR on and after exit day. Part 5 of Schedule 3 makes supplementary provision in respect of Parts 2, 3 and 4.
    Regulation 7 introduces Schedule 4 which makes amendments consequential to the DPA 2018 to the Anti-terrorism, Crime and Security Act 2001 (c.24) and to the Investigatory Powers Act 2016 (c.25). Related amendments appear in paragraphs 76 and 201 (respectively) of schedule 19 to the DPA but have not been commenced. Regulation 7 repeals those provisions.
    Regulation 8 makes amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2002/2013) in light of provision made by the GDPR relating to the meaning of “consent”.'
    See Keeling Schedules showing the amendments.
  • The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019, SI 2019/485. The Explanatory note attached to the Regulations states as follows:
    'These Regulations amend the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419) to reflect arrangements made for personal data to continue to be transferred from the UK to organisations in the United States of America participating in the Privacy Shield Framework, where the participating organisation’s privacy policy includes personal data transferred from the UK in its Privacy Shield commitments. '

UK Brexit guidance:

EU Brexit guidance

Other resources

Disclaimer   -   Copyright   -   Privacy policy