Brexit - Impact on GDPR

Deloitte Advokatfirma

The Brexit transition period ends on 31st of December 2020, and this will impact how you transfer personal data from the EU to the UK. Based on the EDPB's preliminary recommendations Deloitte has pointed out five action points that will prepare you for the end of the transition period.

Published 08.12.2020

In 2021 the UK will not be a part of the European Union, hence a third country in the GDPR context. To be able to transfer personal data from the EU to a third country the GDPR require that effective transfer tools must be in place. Alternative transfer tools are the European Commission’s standard contractual clauses and binding corporate rules. After the ECJ judgment in Schrems II this summer it is evident that strict requirements must be fulfilled to ensure an appropriate level of data protection also when using a transfer tool as standard contractual clauses and binding corporate rules. If the data importer is subject to UK surveillance law, the transfer might be prohibited, at least additional safeguards must be in place.

Action points

  • Map your UK personal data transfers 
  • Know your alternative transfer tools.
  • Assess UK law applicable to your transfers, will the level of protection of natural persons render effective?
  • If your assessment calls for supplementary measures, identify the ones adequate for your transfer. If no one found, stop the transfer.
  • Implement the supplementary measure and the appropriate transfer tool. Keep your transfers under review.


Read the latest insight on Brexit and how it will affect you and your business. 

Read more
Var denne siden nyttig?