What Brexit Changed
When the UK left the EU on January 31, 2020, it took the GDPR with it—sort of. The UK adopted the EU GDPR into domestic law as the 'UK GDPR' and supplemented it with the Data Protection Act 2018. The result? Substantially similar requirements but now under UK jurisdiction.
For businesses, this created a new headache: data transfers. EU organizations transferring data to the UK need adequacy decisions or transfer safeguards. UK organizations processing EU resident data need to comply with both regimes.
But what if the data never crossed borders in the first place?
UK GDPR Key Requirements
The UK GDPR mirrors EU GDPR with these core principles:
- Lawful Basis: You must have a valid legal basis for processing (consent, contract, legal obligation, vital interests, public task, or legitimate interests) - UK GDPR Article 6
- Data Minimization: Collect only what you need for specified purposes - UK GDPR Article 5(1)(c)
- Purpose Limitation: Use data only for the purposes you collected it - UK GDPR Article 5(1)(b)
- Storage Limitation: Do not keep data longer than necessary - UK GDPR Article 5(1)(e)
- Security: Implement appropriate technical and organizational measures - UK GDPR Article 32
- Accountability: Demonstrate compliance through documentation - UK GDPR Article 5(2)
ICO Expectations for Technical Measures
The Information Commissioner's Office (ICO) provides specific guidance on encryption and security measures. Their 'Security' guidance emphasizes:
- Encryption at Rest and in Transit: Data should be encrypted when stored and transmitted
- Pseudonymization: Separating data from direct identifiers reduces risk
- Access Controls: Limit who can access personal data
- Regular Testing: Test security measures regularly and after incidents
ZeyroVault goes beyond these requirements. Our zero-knowledge approach means we never possess the data to encrypt, pseudonymize, or control access to. The data stays on the user's device, protected by their own browser's security model.
The Cross-Border Transfer Solution
One of the biggest post-Brexit challenges is international data transfers. UK organizations sending data to the EU need adequacy. EU organizations sending data to the UK need safeguards. Everyone needs documentation.
Client-side processing eliminates this entirely:
No Transfer: Data never leaves the user's device, so no international transfer occurs.
No Controller: ZeyroVault acts as a tool provider, not a data controller or processor.
User Control: The user maintains full control over their data throughout processing.
This is not just convenient—it is legally significant. The UK GDPR defines 'processing' as any operation performed on personal data. If no operation is performed by your organization, you are not processing personal data under the regulation.
Breach Notification: What You Do Not Need to Report
Under UK GDPR Article 33, organizations must report personal data breaches to the ICO within 72 hours. Failure to report can result in fines up to £8.7 million or 2% of global turnover.
But breaches only matter if personal data is involved. With zero-knowledge tools:
No Personal Data: We do not store names, emails, IP addresses, or usage patterns.
No Breach Risk: A compromise of our systems would reveal no user data because we have none.
No Notification Obligation: No personal data breach means no notification requirement.
This dramatically reduces your breach response burden and associated costs.
Frequently Asked Questions
What is the difference between UK GDPR and EU GDPR?
Substantively, very little. The UK GDPR is essentially the EU GDPR frozen at Brexit, with minor modifications. Both require lawful basis for processing, data subject rights, breach notification, and accountability. The key differences are jurisdictional: UK GDPR is enforced by the ICO, applies to UK residents, and references UK law. EU GDPR is enforced by national DPAs, applies to EU residents, and references EU law.
Do I need an adequacy decision for ZeyroVault tools?
No. Adequacy decisions apply to data transfers between jurisdictions. Since ZeyroVault tools process data entirely client-side, no data transfer occurs between your organization and ours. The data remains on the user's device throughout processing. This eliminates cross-border transfer concerns entirely.
Do I need to register with the ICO if I use zero-knowledge tools?
ICO registration depends on whether you are a 'data controller' under UK GDPR. If your only processing of personal data is through client-side tools where you never access the data, you may not be a data controller for that processing. However, if you process personal data through other means (customer databases, email lists, etc.), you likely need to register. The £40-£2,900 registration fee is based on your overall data processing activities, not just tool usage.
Do I need a Data Protection Impact Assessment (DPIA) for zero-knowledge tools?
Probably not. DPIAs are required for high-risk processing under UK GDPR Article 35. Zero-knowledge tools inherently reduce risk because they eliminate data collection. However, if you combine zero-knowledge tools with other high-risk processing activities (systematic monitoring, large-scale sensitive data processing), a DPIA for the overall project may still be required. Focus the DPIA on the high-risk elements, noting the risk reduction from zero-knowledge components.
References
This guide is based on UK legal frameworks and ICO guidance: