What does Brexit mean for data transfers?

Posted on: Tuesday 05 January 2021 | IAB UK

Following the end of the UK’s Brexit transition period, what does our new agreement with the EU mean for the transfer of data?  

Share this

As we all know, 31 December marked the end of the UK’s Brexit transition period, following a new trade deal with the European Union (EU) passing into UK law. The ‘Trade and Cooperation Agreement’ is now in force on a provisional basis, with EU leaders set to consider the full deal and give their approval - allowing the European Parliament to give its overall approval for full application - before 28 February. 

So what does this mean for the current status of data transfers between the EU and the UK? In short, there is no data adequacy decision yet, but provisions have been put in place to allow data transfers to continue from the EU/EEA to the UK for the time being.  

Update: On 19 February, the EU Commission issued draft data adequacy decisions for the UK. These recognise the UK's high data protection standards and set out the European Commission's decision that the UK's levels of data protection are "adequate". The draft decisions bring the UK significantly closer to its goal of achieving adequacy status, which would allow for personal data to continue to flow freely between the EU and wider European Economic Area (EEA) to the UK. Find out more here

What does this mean?  
Essentially, the ‘Trade and Cooperation Agreement’ contains provisions to allow EU-UK data flows to continue on pre-existing terms for a maximum of six months. This ‘bridging mechanism’ allows data to be transferred in the same way it was pre-1 January 2021 for a "specified period" of four months, extendable by a further two months, provided that the UK makes no changes to its rules on data protection in the interim. 

The period will end when the European Commission (EC) adopts an adequacy decision in relation to the UK, which has always been a separate process to the trade negotiations. If this has not happened by 1 May then the period will be extended by two more months to 1 July, unless either the UK or the EU objects.  

The UK has already deemed the EU/EEA to be adequate on a transitional basis, meaning that data can also continue to flow freely from the UK to the EEA while the UK makes its own formal adequacy assessments. 

What do you need to do?  
While data flows can continue for now, the ICO has issued a short statement here advising that businesses that depend on data received from the EU/EEA put in place alternative arrangements as a precaution, to prevent future disruption. You can find more advice via their Brexit hub

While nothing is certain, the way in which adequacy is addressed in the agreement means we can be cautiously optimistic about the UK being granted adequacy, which would allow data transfers from the EU/EEA to the UK on the same basis as now, although there are no guarantees. We will keep you updated.  

Read our detailed guide on data transfers here.

Don’t forget...  
As well as the transfer of data, it’s important to be aware of the following developments: 

  • GDPR has been retained in UK law and renamed the UK GDPR 

  • The agreement with the EU means that new provisions have been outlined to promote trade in digital services 

  • It also states that the UK and the EU will cooperate on digital trade issues in future, including emerging technologies 

We recommend reading the summary of the Agreement here, with digital trade detailed on page 15.  

Please let us know if you have any questions and we will keep you updated on any relevant developments. 

Written by

IAB UK

Share this

Topics

Related content

person using a computer

EU Commission issues draft data adequacy decision for the UK

The news follows constructive discussions between DCMS and the EU, and would allow data to flow freely from EU/EEA to the UK. Article updated April 2021

... Learn more
Stock

Brexit Deal: Summary & guidance

Explore the business support available post-Brexit and review the Government’s six-point checklist for companies that trade with the EU

Learn more
Stock

Brexit Negotiations: Endgame

With six months left until the end of the transition period, we look forward to the potential sticking points and breakthroughs that we might encounter 

... Learn more
How to get your business prepped for Brexit

How to get your business prepped for Brexit

With 31 October looming and continued uncertainty around a Brexit deal, make sure you’re doing everything you can to prepare your company for the UK’s EU...

Learn more

Why digital advertising works

Discover why digital advertising is effective for reaching your customers and building brands.