Transferring Data Across Borders Post-Brexit?

What effect does the trade deal have on data protection?

Part of the new trade deal states that the EU will delay data transfer restrictions for at least another four months, meaning things will remain the same until the end of April at the earliest. The EU can extend this to six months (known as the bridge).

You can continue to move personal data freely until this bridge ends or we see the implementation of an adequacy decision.

For peace of mind and to position yourself ahead of any new restrictions, it would be prudent to consider new protections prior to the end of April if you rely on data coming into the UK from the EU. For the majority, the best way to do this will be to put a contract in place between you and the sender, based on EU-approved terms. These are known as standard contractual clauses (SCCs). You may find this interactive tool from the ICO useful when considering the best way forward.

What does 'Adequacy' mean?

In simple terms, an adequacy is a formal decision made by the EU which deems that another country, territory, or organisation has an equivalent level of data protection for personal data as itself.

The UK wants to secure this from the EU for both GDPR and LED (Law Enforcement Directive). If this happens, the bridge period described above can end and you will be able to continue to send personal data between the UK and the EU without additional protections in place for as long as the adequacy decision remains in place.

Does the GDPR still apply?

GDPR is an EU regulation meaning post-Brexit it doesn’t apply in the UK anymore. Although, as UK data protection law now incorporates its own version of GDPR (UK GDPR) very similar to EU GDPR, there is little difference between UK and EU data protection practices, rights, and obligations.

The fact that the UK implemented GDPR in 2018 gives it a strong basis for adequacy, but if the bridge period does end without an adequacy decision and you receive data from European organisations, you may need to arrange an agreement with those parties to ensure compliance to both EU and UK GDPR.

Can we still transfer data to and from Europe?

There are no restrictions on data transfers from the UK to Europe. The above guidance is primarily focused on data transfers from Europe to the UK.

Thanks to the bridge, data can continue to move freely in either direction for now. Once the bridge ends, and should the EU not grant adequacy, you may need to make some changes to how you receive personal data from Europe to make sure you comply with the EU GDPR transfer rules. As mentioned above, putting in place standard contractual clauses (SCCs) with the sender will suit the majority.

What do i need to do with data collected before the end of the transition period?

You will need to do a data audit so you’re aware of data you acquired before 31^st December 2020. This data will remain subject to EU GDPR as it stood on that date.

Data you collected after 31 December 2020 will need to comply with the UK GDPR.

Does PECR still apply?

It does. These rules cover cookies, marketing and electronic communications, such as email. They will continue to apply as they are.

Make sure your data is compliant and effective

Take the time to take stock of these rules and make sure all your existing overseas data will remain compliant.

If you’re looking to purchase new data, never before has it been so important to make sure the data you buy is legal, compliant and effective.

That’s the standard of quality data that we base our offering on at i-4business. To help and to show you the scale of our offering, we’re now offering a free 30-day full subscription service. Sign up today for ZERO COST 30-day access!

Our enterprise B2B contact database for tech vendors has contact records over 100 job roles and consists of:

300 verticals

Enterprise and public sector organisations

Data guarantees for accuracy, completeness, and recency

To find out more and to get the most from your free account, you can call the team on 01252 367400.

Get the latest updates on data legislation plus data-driven marketing advice & insights for B2B sales & marketers. If you consent to us contacting you for this purpose, please enter your details below: