The UK will still be subject to European data protection legislation even if it leaves the European Union, according to a lawyer.
The European Commission is currently discussing reforms to data protection legislation within the 28-country bloc that could have a significant impact on the way all businesses treat data such as personally identifiable information.
Proposals for a root-and-branch reform of existing data protection legislation have been in discussion since 2012 and it had been expected new laws would be implemented by 2014.
However, the Snowden revelations of 2013 have caused the discussions to drag on longer and it is thought new legislation will not be brought in until 2016 - the same year David Cameron hopes to hold an in-out referendum on the UK's continuing membership of the EU.
At a press panel held by analytics firm Teradata, Joanne Bone, a partner at lawyers Irwin Mitchell, said: "If we decide to come out of the EU, there are two things [that will happen]. The first is, as the legislation has extra-territorial jurisdiction built into it. If you monitor the behaviour or collect personal data relating to an EU citizen, you will be caught by it wherever you are.
"So if you are in the UK, even if we are out of the EU, if you are trading with Europe in any way ... [including] dropping cookies, then potentially it won't make any difference whether we are in or out. [But] I don't think there are that many businesses these days that are just UK data focused. So I suspect coming out of the EU will have some impact but not a massive impact."
The European Commission hopes to have completed its revamp of data protection laws by the end of 2015, aiming to strengthen citizens' rights over their data, introducing a right to be forgotten, simpler access for citizens to their own data, and the requirement for explicit consent for companies to process someone's data.
Some countries including the UK have raised concerns over the new legislation, with former justice minister Lord McNally claiming SMBs will not benefit.
It means the proposals could be watered down, but three partial-agreements have been reached in the Council of the EU on key aspects of the General Data Protection Regulation.
These cover rules governing how companies process personal data, rules on how the public sector treats personal data and a measure to make it easier for firms to do business in the EU.
