An Update – the Brexit Deal & its effect on your business data protection
On Christmas Eve of 2020, the European Union and United Kingdom had a trade agreement agreed, in principle, in what is was a historic day for both. As part of the agreement we have dissected the contents of this and what it means to you and your business. This update will relate to the landscape and changes faced from a data protection perspective.
The next four months
As of 1 January 2021, the UK and EU have agreed to a further transition period in relation to the future of data protection. For an initial four month period, with potential for a further extension of two months, UK companies who are importing data or working as processors for EU clients will be allowed to continue trading as usual without having to put in place any additional safeguards, such as Standard Contractual Clauses and those discussed in our earlier blog.
Your Business & Data Protection post Transition Period
The logical question to be asking is therefore: what happens after this additional transition period? The purpose of this extended transition, in regards to data protection, is to allow the European Commission sufficient time to continue their assessment of adequacy of the UK’s data protection laws. At the end of this transition period there will therefore be two outcomes: one where the EU deems the UK to have adequate data protection laws, or where the EU does not believe the UK’s laws are adequate.
In the first scenario where the UK is deemed adequate then they this adequacy will act as the safeguard that allows for EU based entities to freely send their data to their UK based service providers. This would be a business-as-usual situation where no changes will need to be made to the operation of your business with your European clients.
However, where there is no adequacy determination, the UK will be treated as a ‘third country’ under the GDPR. In this instance there would be a prohibition on the transfer of personal data from the EU to the UK. The only way around this would be for both parties to ensure that adequate safeguards are in place.
As discussed in our previous blog these would usually be the incorporation of Standard Contractual Clauses or, in the case of larger continental organisations, the implementation of Binding Corporate Rules.
What should you do to be ready?
The takeaway from this is that you should be confident during the next 4 to 6 months when dealing with clients based in the EU. However, given that the transition period is short and there is no guarantee of an adequacy decision you should ensure that any contracts with EU clients have provisions to allow for changes, such as the incorporation of Standard Contractual Clauses on notice, where the UK is not deemed to be adequate after this transition period.
We can help with these changes and ensure that you can continue trading with Europe. Should you wish to discuss this or makes these changes then you can get in contact here: benjamin.rose@acumenbusinesslaw.co.uk or 01273 447 072.
