At the end of this month, the UK is set to leave the European Union. The Government still hopes for a deal but it remains to be seen whether an adequacy decision for the purposes of the General Data Protection Regulations (GDPR) will form part of that deal. If it doesn’t, or if the UK exits with “no-deal,” the UK will be a third-country for the purposes of GDPR in the remaining EU member states and Iceland, Lichtenstein and Norway (the additional countries that along with the EU form the EEA).
This means that companies based in the EEA and sharing data with the UK, will be required to have “appropriate safeguards” in place.
Most straightforwardly, this requirement is satisfied by inserting standard or model contractual clauses into data sharing agreements between European and UK companies, ensuring that parties are bound by EU-standard data protection principles and providing rights to the data subjects. The clauses must be inserted in the data sharing agreement, in their entirety and without amendment.
If you would like any more information about how Brexit may affect your data transfers, please get in touch.
