> The thing about the EU is that every law is like that. This is incorrect. There are Directives (which work like you described) and Regulations, which apply d

> The thing about the EU is that every law is like that. This is incorrect. There are Directives (which work like you described) and Regulations, which apply directly: https://en.wikipedia.org/wiki/Regulation_(European_Union) https://en.wikipedia.org/wiki/Regulation_(European_Union) Per Wikipedia, "As the GDPR is a regulation, not a directive, it is directly binding and applicable, but does provide flexibility for certain aspects of the regulation to be adjusted by individual member states." For most practical purposes, the transition treaty makes it as if the UK was still part of the EU until the end of the year. I believe many member states did also implement it in local law, since they already had privacy laws and just adjusted them to be GDPR-compatible, but the GDPR would also apply directly.