Brexit and Data Protection

Updated 8th January 2021.

What will the impact of Brexit be on data protection and the new GDPR rules brought in by the European Union? Commercial contracts specialist, Rachel Atherton explores some of the more common questions below.

What is the impact of the current deal?

  1. On 1st January 2021, the GDPR stopped having direct effect in the UK. However, UK laws put into place a UK version of the GDPR which is essentially the same – the changes simply make the law relevant to a UK rather than a EU-wide regime. Since the legal regimes are separate they may diverge over time. If you have processing operations in the UK and EU you will need to make sure you know what your obligations are and keep up to date with any changes.
  2. If you do have processing operations in the UK and EU, or if you are targeting customers or monitoring the behaviour of individuals in the EU from the UK, then you will need to consider whether you need to make any changes. For example, you may need to appoint a separate data protection officer for each regime, appoint a representative in the EU and/ or nominate a new lead supervisory authority for the EU data processing activities under the “one stop shop” regime set out in the GDPR, which does not now include the UK’s ICO.
  3. You can still send personal data to countries within the European Economic Area and to any country which has already been granted adequacy by the European Commission without putting in place any special protections to legitimise such a transfer. This is because UK regulations put in place to deal with Brexit grant an interim “adequacy” to these countries and territories. Note that the UK can now make its own adequacy findings so the list of countries this applies too may change over time.
  4. Thanks to the trade deal, it is lawful since the end of the transition period to transfer personal data from the EU to the UK for up to 6 months. This was needed because the European Commission has not yet adopted an adequacy decision in favour of the UK (which is what is needed to allow personal data to continue to flow freely between the UK and the EU). Although it is not enshrined in law, there is commitment from the EU to grant an adequacy decision in favour of the UK shortly. This was probably the largest area of uncertainty and concern with respect to data protection law post the end of the transition period and is good news.
  5. If you haven’t done so already you should review your privacy notices, contracts with third parties with respect to data protection and any data protection impact assessments and any data processing records to make sure they reflect the new legal regime and to make any changes needed.

For further information see the ICO’s guidance for data protection compliance following the end of the transition period

For further analysis of the impact of Brexit on various legal disciplines, please visit our Brexit section or contact a member of the Brexit team.

  • Andrew Holden
    Department: Head of Rural
    Locations: Blackburn, Kendal
    Email me
    Andrew Holden - Head Of Rural Law At Napthens Solicitors
  • Angela Barnes
    Legal Director
    Department: Employment & HR
    Location: Kendal
    Email me
    Angela Barnes - senior associate in employment - Napthens Solicitors
  • Claire Hynes
    Associate Solicitor
    Department: Commercial
    Locations: Preston, Fylde Coast
    Email me
    Claire Hynes Corporate Solicitor At Napthens Solicitors
  • Jon Esner
    Department: Commercial
    Location: Preston
    Email me
    Jon Esner, Corporate partner, Napthens Preston
  • Rachel Atherton
    Senior Associate Solicitor
    Department: Commercial
    Location: Preston
    Email me
    Rachel Atherton Senior Associate Solicitor at Napthens Solicitors
  • Richard Robinson
    Department: Corporate
    Location: Blackburn
    Email me
    Napthens Solicitors Employee Richard Robinson
Meet the team...