This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company.
In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK is still part of the European Union, it is therefore still affected by the GDPR, and may be legally responsible to report a data breach.
One person commented, that said company would only be affected by the GDPR, until the UK would leave the European Union.
Inspired by this, I would like to present a hypothetical situation, in which a UK-based company had a data breach while still affected by the GDPR, but chose not to report it, because that situation would change soon.
However, the relevant offices were informed of the alleged breach, and began conducting an investigation. During this investigation, the UK leaves the EU in a way that EU laws and regulations would not apply to the UK anymore.
If that investigation were later come to the conclusion that the company would have been required to report the breach, would the EU have the right to fine the offending company?