The EU-UK post-Brexit frameworks provide for the UK to have the closest relationship on personal data with the EU outside of the European Economic Area (EEA) and Switzerland. In the area of justice and security, the Trade and Cooperation Agreement itself provides for very extensive data exchange including DNA and fingerprints and is complemented by the first ever mutual adequacy agreement within the area of law enforcement. In some contrast, the general area of data protection is underpinned only by mutual adequacy. Whilst mandating “essentially equivalent” (GDPR, recital 104) protection, significant flexibilities may be retained. Bona fide implementation of the Council of Europe’s Data Protection Convention 108+ could provide a good lodestar for a more graduated regime which also seeks to clearly reconcile data protection with competing rights. The article tentatively examines what that might entail for the data protection’s core substance including the proactive transparency rules, sensitive data regime, accountability provisions and specific restrictions. Any such reform would require great care and should not detract from the need for much more effective practical enforcement.