Home » Brexit and the GDPR

Are you in one of these situations?

Read below to know what you should do!

What Does Brexit Mean For Your Business?

Brexit will change almost every core function for UK companies that do business with the EU: from trade to regulation, hiring and transport, there’s almost nothing that goes untouched by the withdrawal from the EU and the single market. Data protection is unlikely to be at the forefront of companies’ minds during this period, but there are real issues facing data controllers and processors thanks to the GDPR.

During the transition period (i.e. until 31 December 2020), the GDPR continues to apply to the UK. However, the relationship between the GDPR and Brexit beginning in 2021 is unsettled. The UK is no longer a ‘Member State’ and will be considered as a “third country” for GDPR purposes as from 1 January 2021. It will therefore need to negotiate adequacy status with the EU. What this entails and how long it will take is largely up in the air, as both parties must agree on a solution. Until then, data transfers from the EU to the UK will become infinitely more complicated.

Here’s what you need to know about the GDPR and Brexit!

Will the GDPR Apply After Brexit?

Yes, the GDPR will still apply to UK businesses after Brexit.

UK organisations will still need to meet the demands of the GDPR if they offer products or services to individuals who are in the EU or if they monitor the behaviour of such individuals. As a result, most UK organisations will still need to be GDPR compliant regardless of any trade or Brexit deals. This is already true for third countries, which the UK will become as from 1 January 2021.

The third-country status will bring significant changes for UK data controllers and processors because they will be subject to cross-border data transfer requirements and they may have to appoint a GDPR representative in the EU.

The UK: A Safe Place for Data Post-Brexit?

The GDPR requires that data transfers to any third country occur only with countries designated as ‘adequate’ by the European Commission.

Countries with adequacy are those that use an EU-equivalent level of data protection. As a result, they aren’t bound by Article 46 and 47 of the GDPR, and data can flow between the EU and these countries without limits or checks. At present, countries recognized as being adequate for data transfers include Andorra, Argentina, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, and Uruguay.

Canada and Japan are also included, but there are limitations to data transfers to these countries. In Canada, only commercial organisations benefit. In Japan, the adequacy decision only covers private sector organisations.

The U.S. was also included via the US-EU Privacy Shield – but only for U.S. companies that signed up to the framework – but this mechanism was recently invalidated by the Court of Justice of the EU, meaning that data transfers between the EU and the US are no longer considered as safe or protected, unless appropriate safeguards are put in place and if the rights of individuals are enforceable, and effective legal remedies are available.

What comes next for the UK will depend on any data protection agreements worked out in the transition period. The UK already uses the Data Protection Act 2018, which issued requirements similar to the GDPR in terms of privacy and transparency.

However, the most comprehensive understanding of what will be the UK version of the GDPR can currently be found in the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019.

Will Companies Be Able to Send Data Between the UK and the EU?

At present, the UK government does not intend to consider the EU as a third country in terms of UK data processing. As a result, UK companies will be able to continue sending data to the EU. However, the EU has not reciprocated this commitment, which means that EU data transfers to the UK will face restrictions.

The results are likely to be messy. UK-based organisations will struggle to serve customers within the EU. It will also present unique challenges on the island of Ireland as well as for Gibraltar/Spain, where ties with the EU are intimate.

Lifting the restrictions will depend on the UK and each relevant company meeting the EU’s safeguards for supporting data transfers. The requirements for third country data transfers are detailed in Chapter V of the GDPR.

When Will the Data Transfer Rules Change?

The Withdrawal Agreement acknowledged by the EU and the UK government stipulated a transition period to last from January 31, 2020 to December 31, 2020. During this period, the UK agreed to continue following EU laws and regulations despite the ‘exit’ taking place in January 2021. As from 1 January 2021, the UK will be a third country.

As a result, data transfers (and the provisions or rights) continue as normal for both EU and UK companies and residents for the duration of 2020, until the end of the transition period.

However, there will not be a clean break. Any EU-originating data in the UK prior to the end of the transition period will still benefit from the GDPR as written and amended by the EU. The product is a backstop that continues to protect the privacy of individuals in the EU regardless of the outcome of negotiations for 2021 and beyond.

Ideally, the GDPR will then be superseded by the UK’s adequacy decision, granted by the EU. 

I am a UK company: what should I do?

I am an EU/EEA company: what should I do?

My company is not located in the EU or in the UK: what should I do?

Your obligations in a nutshell