The UK government has taken some action to address these uncertainties, including the recent ratification of Convention 108+, an agreement on robust data protection principles and rules signed by 25 other countries – 19 from Europe and six from the rest of the world.
This convention lets the signatory states share data, providing they implement its principles, which are aligned to the General Data Protection Regulation (GDPR). Although this does not remove the Brexit uncertainty, it will lessen the impact of a no-deal scenario and help to enable the continued flow of personal data.
Despite this move, organisations, especially those that trade in information between the UK and the EU, will need to take action to minimise any cyber security issues when trading with the EU and other countries.
That should include continued monitoring of new cyber-related laws and regulations in other countries and a process for assessing whether there is a business need to meet these new requirements, rather than just the local UK-based ones, such as Cyber Essentials.
This should be supplemented by a review of the organisation’s cyber security standards to ensure that it is not locked out of important markets. This may well mean adopting even more stringent or different controls relating to cyber security than we have today or in the future to ensure the business can continue to trade.
Good cyber security practice should remain a priority, including deploying an adequate proactive threat intelligence service to monitor the potential for increased cyber attacks. It is possible that malicious actors could look to exploit a disorderly exit and look for loopholes in current systems or use uncertainty and inconsistency in the cyber security laws between the UK and Europe to find new ways to attack systems.