Much of it comes from GDPR law which was passed prior to brexit. After brexit, the UK kept most of the regulation under the "UK GDPR", meaning it does apply in the UK as well.