GDPR And Brexit: What Does Brexit Mean For Your UK Business?

Brexit will change almost every core function for UK companies that do business with the EU: from trade to regulation, hiring and transport, there’s almost nothing that goes untouched by the withdrawal from the EU and the single market. Data protection is unlikely to be at the forefront of companies’ minds during this period, but there are real issues facing data controllers and processors thanks to the GDPR.

Will GDPR apply post Brexit? Here’s what you need to know about the GDPR Brexit implications!

Will GDPR Still Apply After Brexit?

Yes, the GDPR will still apply to UK businesses after Brexit.

UK organisations will still need to meet the demands of the GDPR if they offer products or services to individuals who are in the EU or if they monitor the behaviour of such individuals. As a result, most UK organisations will still need to be GDPR compliant regardless of any trade or Brexit deals. This is already true for third countries, which the UK will become as from January 1, 2021.

The third-country status will bring significant changes for UK data controllers and processors because they will be subject to cross-border data transfer requirements and they may have to appoint a GDPR representative in the EU.

Will Companies Be Able to Send Data Between the UK and the EU?

At present, the UK government does not intend to consider the EU as a third country in terms of UK data processing. As a result, UK companies will be able to continue sending data to the EU. However, the EU has not reciprocated this commitment, which means that EU data transfers to the UK will face restrictions.

The results are likely to be messy. UK-based organisations will struggle to serve customers within the EU. It will also present unique challenges on the island of Ireland as well as for Gibraltar/Spain, where ties with the EU are intimate.

Lifting the restrictions will depend on the UK and each relevant company meeting the EU’s safeguards for supporting data transfers. The requirements for third country data transfers are detailed in Chapter V of the GDPR.

When Will the Data Transfer Rules Change?

The Withdrawal Agreement acknowledged by the EU and the UK government stipulated a transition period to last from January 31, 2020 to December 31, 2020. During this period, the UK agreed to continue following EU laws and regulations – including the GDPR – despite the ‘exit’ taking place in January. As from January 1, 2021, the UK will become a third country.

As a result, data transfers continue as normal for both EU and UK companies and residents for the duration of 2020, until the end of the transition period.

However, there will not be a clean break. Any EU-originating data in the UK prior to the end of the transition period will still benefit from the GDPR as written and amended by the EU. The product is a backstop that continues to protect the privacy of individuals in the EU regardless of the outcome of negotiations for 2021 and beyond.

What comes next for the UK will depend on any data protection agreements worked out in the transition period. The UK already uses the Data Protection Act 2018, which issued requirements similar to the GDPR in terms of privacy and transparency.

However, the most comprehensive understanding of what will be the UK version of the GDPR can currently be found in the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019.

Don’t Forget This Specific Obligation!

If your UK company doesn’t have an establishment in the EU and you offer products or services to individuals who are in the EU or if you monitor the behaviour of such individuals (including UK citizens living within the EU), then you will most likely have to appoint an EU data protection representative.

An EU representative is NOT a Data Protection Officer (DPO). Instead, an EU data protection representative is a natural person or body within the EU who is your point of contact for individuals in Europe, as well as regulators. (A DPO works with your company or organisation to facilitate compliance.)

UK companies will not already have an EU representative because there is no need for one as long as they are not located in a third country.

To be compliant with the GDPR, you will need an EU representative in place by the end of the transition period (i.e. as from January 1, 2021), unless you can claim the application of the restrictive and cumulative exceptions of Article 27(2) of the GDPR.

Take our quick assessment test to find out if you need to appoint a GDPR EU representative.