FYI, that's not quite correct. The EU makes laws in several ways. A directive is, as you said, a measure that individual member states then incorporate into the

FYI, that's not quite correct. The EU makes laws in several ways. A directive is, as you said, a measure that individual member states then incorporate into their own national law to give it legal weight. But the GDPR is, as its name suggests, a regulation, which means it carries legal weight immediately and in its own right across the entire EU. The UK's position is strange because of Brexit, but it seems the practical position of all recent governments has been that existing EU laws should be transposed into UK national laws where necessary and with the required changes to make sense, until such time as our national authorities might decide to deviate from them. Primary legislation has already been made to that effect. The big question is what "that effect" actually is, given the huge volume of legislation affected and the potential ambiguity in what changes are required for any given law of EU origin to continue to make sense in a post-Brexit UK.