GDPR comes into force in May 2018. The UK will still be a member of the EU at that point and, even if Mrs May hadn’t pledged that the UK would be a fully-functioning member right up to the point of departure, the legal reality is that GDPR will be in force, and will have to be enforced, from May 2018.
There is no certainty that the UK will have left the EU by April 2019; 48% of the electorate voted to remain and, over the next two years, the realities of post-Brexit life will become clearer to everyone. It’s very possible that the UK’s position on Brexit will change before April 2019; “events, dear boy, events” have a tendency to disrupt all sorts of hopes.
The Great Repeal Bill will enact all EU laws into UK law. The British Parliament will then have to selectively repeal those laws that it has a mandate to repeal. It’s difficult to believe that the GDPR will have a high priority, so it will continue in force beyond actual legal Brexit.
Preparation for GDPR compliance will take time – and the clock is ticking. The fines, and room for data subjects to bring their own actions, could be very costly.
No room or time for confusion: get to work, and start protecting consumers and shareholders!