The EU GDPR was introduced to harmonise data protection rules across the whole of the European Union in May 2018 and it has direct effective in each EU Member State. The EU GDPR applied to all processing of personal data in the context of activities of an establishment of a controller or processor in the UK until the end of 2020.
Following the end of the Brexit transition period, the EU GDPR can still apply to a UK-based controller or processor where it is processing personal data of individuals in the EU in order to “target” them either by offering goods or services to them, or by monitoring their behaviour.
However, the fact of processing personal data of an individual in the EU alone is not sufficient to trigger the application of the EU GDPR to personal data processing activities of a UK-based controller or processor – the element of “targeting” individuals in the EU must be present for the EU GDPR to apply.