The UK has left the European Union (EU), the transition period is over, the UK and EU have agreed a new Trade and Cooperation Agreement (the TCA), so what now for data protection? We look at the key consequences of Brexit for data protection and the practical impact for organisations: What law applies? What must businesses do to allow for the uninterrupted flow of data to and from the UK? What changes to policies, procedures, privacy notices and documents are required? Should Data Protection Officers and Representatives be appointed or those roles restructured? Many organisations will have taken steps already and certainly the necessary approach to most questions is clear. But beware, all is not set in stone just yet.