Post Brexit and during the transition period of the withdrawal agreement the GDPR will continue to apply in the UK.
What happens after the transition period ends?
This depends on the outcome of negotiations between the UK and EU. Strictly the GDPR will no longer apply however the UK government has committed to incorporating the GDPR into UK law and has already substantially done so via the Data Protection Act 2018. Business should assume that the GDPR will apply for the foreseeable future.
Whatever the outcome, the GDPR will still apply to businesses which trade in the EU in relation to their activities in the EU.
Is the UK a ‘third country’ for the purpose of data transfers from the EU or EEA?
The GDPR restricts data transfers from countries within the EEA to countries outside the EEA. These restrictions will apply to the UK after the transition period ends.
The least onerous means of complying with these restrictions is for an ‘adequacy decision’ to be in place from the European Commission which states that the UK provides equivalent protection to personal data. The Commission has hinted at granting an adequacy decision but one is not yet in place and there is no guarantee it will be before the end of the transition period.
This means (pending the outcome of negotiations with the EU) transfers from the EEA to the UK will have to comply with one or more of the other requirements of third country transfers set out in the GDPR. These include binding corporate rules, standard contractual clauses and consent in limited circumstances.
UK businesses need to prepare for the end of the transition period now and the possible absence of an adequacy period or face being unable to receive data from the EU after the transition period ends.
Find out more
If you would like any help or support then visit our dedicated Intellectual Property pages or contact our expert team.
