Week 6 – Data Protection and GDPR in a post Brexit World

Week 6 New
  • 4th December 2020

After the Brexit transition period ends on 31 December 2020, the EU GDPR will no longer be law in the UK. However, as the UK government intends to write the GDPR into UK law, from all practical perspectives, GDPR will continue to apply.

This means UK organisations and individuals that process or transfer the personal data of EU-27 citizens from the EU to the UK may need to take action to continue the free flow of data from the EU to the UK and guarantee the protection of EU data subjects. The action required will vary according to whether there is a deal (as set out in any withdrawal agreement) or no deal. After transition, the UK will be a "third country" until the EU makes an adequacy decision regarding the UK. Until then, the transfer of personal data from the EEA to the UK will only be allowed if ‘appropriate safeguards’ are in place. Such safeguards include Standard Contractual Clauses (SCCs). SCCs must be inserted into contracts (whether controller to controller or controller to processor) before Brexit, and their wording must follow that approved by the European Commission.

Transfers of personal data to the EU/ EEA from the UK will not be affected and transfers to and from countries outside of the EU/EEA will be subject to the same rules as now.

The Information Commissioner’s Office (ICO) has published a checklist of six steps that businesses can take now to start preparing for data protection compliance in the event of no-deal.

View this checklist here.

The government has also produced guidance on using personal data after Brexit, this is available here.

Here to Help

To help SMEs prepare for Brexit, we have produced some useful materials including:

If you would like any further guidance or help with regards to Brexit, please do get in touch.

For further information about Brexit and for useful links and resources please visit our hub page.

All data and figures referred to in our news section are correct at the date of publishing and should not be relied upon as still current.