The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations (the Regulations)(1) that have been in force since 31 December 2023 are insufficient to stabilise the UK’s data protection frameworks now that the legal uncertainty unleashed by the Retained EU Law (Revocation and Reform) Act 2023 (REULA) has engulfed us.

Continuity and legal certainty – retained EU law

Saving EU rights and obligations: When the UK stopped being subject to the EU Treaties at the end of 2020, the European Union (Withdrawal) Act 2018 (EUWA) saved the rights and obligations which applied in domestic law as a result of the UK’s EU membership.(2) This meant that the EU GDPR became the UK GDPR(3). The Data Protection Act 2018 (DPA 2018) remained on the statute book(4). They became part of “retained EU law” – the vast body of law saved on the UK’s departure from the EU legal framework.