In the event of a no-deal Brexit, organisations can no longer transfer personal data to the United Kingdom (UK) unless they implement appropriate data transfer mechanisms. For many organisations, entering into EU model contracts is the best way to go forward.

What is the impact on personal data transfers to the UK?

In the absence of a withdrawal agreement between the EU and the UK, the UK will become a ‘third country’ from 29 March 2019. Since it is unlikely that the European Commission makes an adequacy decision in favour of the UK before this date, organisations will be prohibited from transferring personal data to the UK, unless they put in place an appropriate data transfer mechanism.

Does this this affect my organisation?

If you are a controller established in the EU and transfer personal data to UK recipients, including group companies, service providers or other third parties, you should take immediate action.

“We advise implementing appropriate data transfer mechanisms as soon as possible”
Jeroen Koëter
IT lawyer at Project Moore

What steps should I take?

The first step is to identify which of your processing activities may be affected by a no-deal Brexit. These may include transfers of HR data to group companies, IT (cloud) service providers who have access to consumers data or third parties who process data on your behalf. The second step is to determine the appropriate data transfers mechanisms. There are several transfers mechanisms available, but for many organisations entering into EU model contracts with the UK recipients is the appropriate solution. In parallel, update your data protection documentation, such as your data record register and privacy notices.

We will gladly help you think this through and meanwhile continue to monitor the legal landscape.

Email us or give us a call at: +31 20 5200 870.

Additional information

The European Data Protection Board has published an information note on data transfers in the event of a no-deal Brexit.

The standard contractual clauses for data transfers between EU and non-EU countries can be found here.

Further information from ICO can be found here.