Data protection and Brexit

The UK will become what is known as a ‘third country’ by the EU when the transition period ends on 31 December 2020. This means UK organisations or individuals cannot assume they can continue to process the personal data of EU data subjects in the same way as now.

We have summarised actions you might need to take in preparation and also included a link to an interactive tool from the ICO for SMEs.

Unless there is an ‘adequacy decision’ or one of the alternative ‘safeguarding mechanisms’ approved by the EU are in place, the transfer of the personal data of EU data subjects from the EU/EEA to the UK will not be allowed. While the government are expecting an adequacy decision to be in place by 1 January 2021, there is no guarantee this will happen.

The transfer of personal data from the UK to the EU will not be affected but you must continue to comply with the DPA 2018.

For organisations that do not have a presence in the EU but process the personal data of EU data subjects, you may need to look at making alternative arrangements as the ‘one-stop shop’ principle will no longer apply.

In addition, any documentation, such as Privacy Notices, that refer to EU legislation will need to be updated so they reflect the new UK legislation that will be in place from 1 January 2021.

How can you prepare?

1. Review your data flows to see if you receive or process the personal data of EU data subjects or may do so in the future.
2. Read the ICO’s guidance on all international data transfers and the one-stop shop for detailed information and examples.
3. Read the ICO’s guidance on Brexit and the end of the transition period. The ICO has prepared an interactive tool for SMEs which you may find useful. It is also a good idea to sign up to receive the ICO’s newsletter to keep abreast of developments.
4. Read the government’s latest guidance and sign up to the government’s transition alert email service.
5. Seek legal advice where in doubt.