Part I of this chapter traces the evolution of UK data protection legislation, outlines the UK government’s rationale for enacting the Data Protection Act 2018 (DPA 2018) to supplement the GDPR even though the UK is on course to leave the European Union (EU), and comments on the most interesting derogations, exemptions, and adaptations to the GDPR in the DPA 2018 – some of which are controversial, and could prove problematic in the future. Part II sets out the data protection implications of the UK leaving the EU with transitional withdrawal arrangements in place or on a ‘no deal’ basis. It outlines why the UK may struggle to obtain a finding of adequacy from the European Commission, and how the Information Commissioner’s Office (ICO) will suffer a loss of status and influence when the UK becomes a ‘third’ country for data protection purposes. It concludes that departure from the EU will not result in significant UK divergence from the GDPR
