How 'flexible' can the UK actually be on EU data protection law?

It's certainly going to try to be a little bendy

If EU member states can, by law, exercise legislative "flexibility" when implementing 50+ Articles of the General Data Protection Regulation (GDPR), how can the regulation ever become harmonised across European Union?"