What does Brexit mean for data protection?

The key consequence of the UK leaving the EU is that it could eventually become a “third country” for the purposes of EU-to-UK personal data transfers.

For now, however, the UK has entered into a Trade Agreement with the EU which includes a grace period to ensure compliance with relevant data protection laws. As of 01 January 2021, and under the Trade Agreement, personal data may be transferred from the EU to the UK as if the UK has not become a third country.

How long does the grace period last?

The grace period started on 01 January 2021 and will last for an initial period of four months. This will then be extended by a further two months unless either the EU or the UK object.

Why do we have a grace period?

The purpose of the grace period is to allow more time for the European Commission (EC) to consider whether to grant the UK “adequacy”. If adequacy is granted this would permit unrestricted EU-to-UK personal data transfers.

What happens if an adequacy decision is reached?

If the EC adopt a UK adequacy decision during the grace period, the grace period will automatically cease as it will no longer be needed

However, if the EC does not make a UK adequacy decision during this period, then, (subject to any other measures that are agreed in the interim), the UK will be considered a third country for personal data transfers from the expiry of the grace period.

Next steps

You should monitor legal updates on whether an adequacy decision is provided to the UK to ensure you are aware of the actions you need to take to ensure ongoing compliance with both the UK and European data protection regimes.

Should you require any support with undertaking a data mapping exercise of your data processing processes, please get in touch with us.