Data protection

Data protection regime since 25 May 2018

The data protection regime introduced by the General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) came into force on 25 May 2018 and applied in the UK until IP completion day (11 pm on 31 December 2020). The EU GDPR introduced a raft of changes to the previous data protection regime, including new and extended data subject rights, a new standard for consent, additional obligations and liabilities for data controllers and data processors, and extended powers for supervisory authorities. The EU GDPR continues to apply in the European Economic Area (EEA) beyond IP completion day, but not in the UK.

In the UK, the EU GDPR was replaced on IP completion day by the UK GDPR regime. The UK GDPR regime uses, as its starting point, two key pieces of legislation:

1. •

   a version of the EU GDPR which was incorporated into UK law (with various amendments made by Brexit legislation) on IP completion day (Assimilated Regulation (EU) 2016/679, the UK GDPR)

2. •

   the parts of the Data Protection Act 2018 (DPA 2018) that relate to general personal