Brexit - Impact on GDPR

Published 08.12.2020

In 2021 the UK will not be a part of the European Union, hence a third country in the GDPR context. To be able to transfer personal data from the EU to a third country the GDPR require that effective transfer tools must be in place. Alternative transfer tools are the European Commission’s standard contractual clauses and binding corporate rules. After the ECJ judgment in Schrems II this summer it is evident that strict requirements must be fulfilled to ensure an appropriate level of data protection also when using a transfer tool as standard contractual clauses and binding corporate rules. If the data importer is subject to UK surveillance law, the transfer might be prohibited, at least additional safeguards must be in place.

Action points

• Map your UK personal data transfers 
• Know your alternative transfer tools.
• Assess UK law applicable to your transfers, will the level of protection of natural persons render effective?
• If your assessment calls for supplementary measures, identify the ones adequate for your transfer. If no one found, stop the transfer.
• Implement the supplementary measure and the appropriate transfer tool. Keep your transfers under review.