Please ensure Javascript is enabled for purposes of website accessibility

EU Exit: Data

DATA 

The way data can be transferred between the UK and the EU changed on 1 January 2021, when the transition period ended.

The EU Commission announced on 28 June 2021 that adequacy decisions for the UK have been approved, we are awaiting further guidance.

Depending on what data you share and who the data is shared with, will affect the changes you may need to make:

UK business with no contacts or customers in Europe 

If your UK business already complies with the GDPR and you have no contacts in the EEA who send you data, and no customers in the EEA, you do not need to do much to comply now that the Brexit transition period has ended.

  • Make sure you review your privacy information and documentation to identify any minor changes that need to be now the Brexit transition period has ended.

UK businesses who send or receive data to or from Europe

If your UK business receives data from contacts in the EEA, you need to take extra steps to ensure that the data can continue to flow. 

  • UK businesses will be covered by the UK data protection regime.
  • If you send data from the UK to the EEA you will still be able to do so and you don’t need to take any additional steps.
  • If a business or organisation in the EEA is sending you personal data, then it will still need to comply with EU data protection laws. Data can continue to flow whilst the bridge is in place.: 

For most businesses and organisations, SCCs (Standard Contractual Clauses) are the best way to keep data flowing to the UK. Use ICO's SCC Interactive Guidance tool.

  • Data you collected before the end of 2020 about people who were located outside the UK at the end of 2020 will be subject to the EU GDPR as it stood on 31 December (known as the ‘frozen GDPR’). You may use the latest information you have about where people were living, up to 31 December 2020. Personal data acquired since 01 January that is processed on the basis of the Withdrawal Agreement (for example if personal data is processed under a provision of EU law that applies in the UK by virtue of the Withdrawal Agreement) is also subject to the frozen GDPR.
  • Make sure you review your privacy information and documentation to identify any minor changes that need to be made at the end of the transition period.
  • Keep up to date with the latest information and guidance.

UK businesses with a European presence or European customers

  • You need to comply with both UK and EU data protection regulations. You may also need to appoint a representative in the EEA.
  • You will need to comply with the UK data protection regime for your activities in the UK.
  • If you have offices, branches or other establishments in the EEA, your European activities are covered by EU law. You can check which European data protection regulator will be your ‘lead supervisory authority’.
  • Data you collected before the end of 2020 about people who were located outside the UK at the end of 2020 will be subject to the EU GDPR as it stood on 31 December (known as the ‘frozen GDPR’). You may use the latest information you have about where people were living, up to 31 December 2020. Personal data acquired since 01 January that is processed on the basis of the Withdrawal Agreement (for example if personal data is processed under a provision of EU law that applies in the UK by virtue of the Withdrawal Agreement) is also subject to the frozen GDPR.
  • If you are only based in the UK but you offer goods or services to individuals in the EEA, or monitor the behaviour of individuals in the EEA, you need to comply with the EU data protection regime in relation to these activities. In most cases you will also need to appoint a suitable representative in the EEA. This person will act as your local representative with individuals and data protection authorities in the EEA. You need to find a provider in the EEA who offers services as a GDPR representative. If you have a data protection officer (DPO), this cannot be the same person or one of your processors. 

Government Tools

Contact the Growth Hub

Chat Bot Logo
Cheshire and Warrington