How should you handle EU Data Transfers upon Brexit?

Last updated 4:40pm, 23 February 2021

If you are an organisation that receives flows of personal data from the EU, you will need to consider steps to ensure such flows can lawfully continue.This is because the EU GDPR does not permit transfers of personal data from the EEA to third countries without certain safeguards or exemptions being in place.The UK is now a “third country” for data transfer purposes.The UK and EU have agreed a six-month transitional period (commencing 1 January 2021) that permits the free-flow of personal data from the EU to the UK. The purpose of this transitional period is to give the EU time to determine an “adequacy decision” in the UK's favour that would allow the UK to receive data transfers from the EU in the longer term.On 19 February 2021, the EU issued a draft adequacy decision in the UK's favour that, if approved, will permit the UK to receive free-flowing transfers of personal data from the EU (as the UK did prior to the end of the Brexit transition period). For further details see International Data Transfers: EU publishes draft Adequacy Decision. Meanwhile, the EU has adopted revised Standard Contractual Clauses to cover and legitimise data transfers from the European Union to third countries (see EU Adopts Revised EU Standard Contractual Clauses). Particularly if the EU adequacy decision is not approved, these may be important for future EU-UK data transfersThe information below summarises what your organisation needs to consider, and how it should deal with its data transfers from the EU. Whilst the EU's draft adequacy decision is of some comfort to UK businesses, the UK is still not certain to receive an approved adequacy decision in its favour at the end of the six month transition period. Businesses should therefore still make risk-based contingency plans in the event that the UK is not deemed adequate, and they need to legitimise their data transfers from the EU:

Review and map your current data flows from the EU

You will need to identify your data flows from the EU to the UK, so you can understand which flows you need to legitimise, and how.

---

Prioritise your key data transfers by volume of data and other factors

If time is running short, you might need to prioritise your business-critical and high volume flows first, or those flows that cover sensitive data.

---

Consider how you may continue to receive these transfers lawfully at the end of the transition period

The most likely mechanism to use will be Standard Contractual Clauses (“SCCs”) to document the data flows. There are alternatives and exemptions that you may consider as well.

---

Implement the mechanisms to permit data flows

You will need to have this in place before the end of the transition period, in the event the UK does not receive an adequacy decision in its favour.

---

Update your privacy notices, policies and procedures as necessary

You may need to update your privacy policies and notices to reflect the changes you have made in readiness for post-Brexit transition.

---

What about Data Transfers from the UK to the EU?

You may continue to transfer personal data from the UK to the EU post-Brexit transition as before, without taking further steps. The UK government has said that data transfers from the UK to the EU will not be restricted.

---

How can Freeths help?

We have a team of specialist Data and Information lawyers who can guide you through this process. Examples of how we can support your organisation include:

• Mapping your data flows
• Advising on the right safeguards or exemptions to use, including SCCs
• Drafting and negotiating the use of SCCs in your contracts with third parties in the EU
• Updating your privacy policies and procedures

---

Head to our Brexit Exchange where you will find all the latest updates and developments from our experts, regarding Brexit and how that affects businesses and individuals in a range of areas.