So-called Brexit will take a while to arrive. Prime minister David Cameron indicated Friday morning that he will stay on for three months before handing over to a successor, and he wants the next prime minister to begin the negotiations with the EU over the terms of the exit. That could take two years, so Britain will probably only leave in 2018.

That means years of uncertainty, with tech firms and investors unable to know for sure how regulations will evolve (or devolve) in the U.K. and, indeed, the EU.

Get Data Sheet, Fortune’s technology newsletter.

As Stratechery’s Ben Thompson has correctly noted, the U.K. is one of the voices in Europe that has called for relatively light-touch tech regulation in the EU. Without it, Germany and France will have even stronger positions in the bloc than they currently do.

Germany and France are the countries that have taken the lead on cracking down on American tech firms, such as Google, over their perceived transgressions. Without British pushback, that stance is likely to gain more heft.

Then there is the issue of data and its ability to flow across borders.

You may have been following the tumultuous trajectory of EU-U.S. data transfers—the fall of the Safe Harbor agreement and the attempted rise of its replacement, Privacy Shield. Right now, U.S. multinationals and tech firms are running out of ways to legally process the data of EU citizens. This is because the EU has so far been unable to finalize an “adequacy” decision that would declare the U.S. safe as a destination for Europeans’ personal data. (Negotiators claimed a breakthrough on Friday, but champagne might be premature.)

When it leaves the EU, the U.K. will be in the same boat—again, if British companies want to process the personal data of employees and customers on the European mainland, the country will need to win an adequacy decision.

This was confirmed on Friday morning by the U.K. Information Commissioner’s Office (ICO), the country’s privacy watchdog. The ICO said the U.K.’s existing Data Protection Act, which is based on older EU rules, would remain in force. However, the upcoming EU privacy reforms—the much tougher General Data Protection Regulation—will not apply to the U.K. directly.

This means the U.K. will have to reform its privacy laws in line with the new EU rules, even though it is leaving, or face big barriers to cross-border data flows. “Having clear laws with safeguards in place is more important than ever given the growing digital economy, and we will be speaking to government to present our view that reform of the U.K. law remains necessary,” the ICO said.

Foreign tech firms may not be so keen on the details of the new EU rules—they clear the way for massive fines for privacy violations, and allow people to opt out of being profiled online—but they do at least welcome the uniformity that they promise. The EU currently has a patchwork of privacy laws, and the General Data Protection Regulation is supposed to provide harmonization. So tech firms, too, will likely want to see the U.K. align its laws with the EU on this front.

However, that might not be enough to win an adequacy decision. The big problem here is surveillance.

The main reason Safe Harbor fell was the mass surveillance policies of the U.S. The U.K. also has mass surveillance programs that affect other countries (and it is currently trying to shore up the underlying legislation), but while it is part of the EU, the U.K.’s behavior cannot stop data flowing between it and the mainland. Once it is no longer in the EU, that situation will change dramatically.

For more on Brexit, watch our video.

It is by no means a certainty that the U.K. will be able to continue to participate in the European single market—something that Brexit campaigners promised, but that may be tricky to negotiate in the face of hostility from EU governments.

The majority of British tech startups came out against Brexit ahead of the vote. They warned that Brexit would hurt confidence in the sector and make it more difficult to hire talent from abroad. Microsoft warned that Brexit would make it less likely to invest more in the U.K.

And the U.K.’s rivals won’t hold back in taking advantage of the situation. Just hours after the referendum result came through, the Berlin-based venture capital provider German Startups Group issued a statement proclaiming that “Brexit is good news for the German startup scene.”

“Only since 2015 was Berlin able to surpass London, the previously dominant hub of Europe, in the number of and overall volume of financial transactions from startups,” said CEO Christoph Gerlinger. “This development will now accelerate and the distance between Berlin vs. London will increase. We expect a significant decrease in new incorporations in London in favour of Berlin, as well as an influx of successful London startups. This will be particularly true of the especially dynamic [financial technology] sector.”

The Federation of German Startups also said Berlin will emerge as the winner in the Brexit scenario, although it added: “It is a victory we do not want and will not be celebrating.”

As for tech users, British people may no longer be able to get cheap mobile calls and data when they visit the EU, as recent EU legislation allows. The new EU net neutrality rules now probably also won’t apply in the U.K., which could be bad news for consumers there.

Another thing to look out for will be radio spectrum. The EU is currently on a drive to harmonize the spectrum allocations made by countries around the bloc, in order to help the manufacturers of mobile devices, for example, to achieve efficiencies of scale.

With 5G around the corner, nobody wants countries diverging on which radiowaves they assign to super-fast mobile broadband. The U.K. will now no longer have to go along with the decisions made on the mainland—although again, following the EU’s lead would be the most obvious choice to make.

For now, all eyes are rightly focused on the post-Brexit carnage taking place in global markets—chaos that may well have its own impact on the tech sector. But in the long term, the repercussions of Thursday’s decision could be very profound and complex.