Brexit and the impact on data transfer

As of 1st January 2021, the UK and Northern Ireland are no longer a part of the European Union, and with this significant change come adjustments to policies and legislation.

The EU-UK Trade and Cooperation Agreement sets out arrangements between the EU and the UK in several areas including trade of goods and services, digital trade and data transfer, intellectual property and public procurement. The Agreement is underpinned by policy and provisions that aim to ensure equal opportunity and respect for fundamental rights.

Along with changes to the movement of goods between the EU and the UK, as well as between the UK and NI, changes have also been implemented with regards to the transfer and use of data. The UK is now received as a third country to the European Economic Area (EEA includes EU countries and also Iceland, Liechtenstein and Norway) and therefore data transfer from EEA to UK is restricted; data transfer however out of the UK to the EEA is not. Northern Ireland is not treated any differently to the rest of the UK for data protection purposes.

As part of the new trade deal, the EU agreed to delay transfer restrictions through a bridging arrangement. This provision is in place until the end of April however there is possibility of extension to the end of June if no “Adequacy Decision” is reached (an adequacy decision is the formal decision recognising that another country, territory or international organisation provides the same level of protection for personal data as the EU). This bridging period will allow personal data to continue have an unrestricted movement from the European Economic Area (EEA) to the UK until adequacy decisions are adopted. At present, the UK is requesting adequacy decisions for the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED).

For now, EU GDPR transfer rules will continue to apply to any data coming from the EEA into the UK unless the EU Commission makes an adequacy decision before the bridging period ends. Following the conclusion of the bridging period the EU GDPR will no longer apply to the UK as it is an EU Regulation, however you will still need to comply with UK data protection law. The UK GDPR has been integrated into UK data protection law and in theory there is little change to the core data protection principles, rights and obligations that organisations and businesses will be used to. In some instance the EU GDPR may still apply directly to your organisations if you operate in the European Economic Area (EEA), offer goods or services to individuals in the EEA, or monitor the behaviour of individuals in the EEA.

Businesses and organisations should also be aware that if you have an office, branch/other established presence, or customers in the EEA, you need to comply with both UK and EU data protection regulations and may need to designate a representative in the EEA. This person will be someone who offers services as a GDPR representative and will act as your local presence in the EEA, working with individuals and local supervisory authorities in that area. Organisations will need to update their privacy notice with the details of their EU Representative and advise the Local Supervisory Authority. Public authorities or those with occasional/low risk data transfers will not need to appoint a representative.

The Information Commissioners Office (ICO) have recommended that all businesses and organisations who receive personal data from the EEA to implement safeguards before the end of April, and not to wait until the bridging period ends. These safeguarding mechanisms are Standard Contractual Clauses and Binding Corporate Rules. Templates and information on both these are available on the ICO website. The latter however is mainly just for large multinational organisations and therefore will most likely not apply to much of the Voluntary and Community sector.

For more information, visit the ICO website where there is detailed guidance on Data Protection at the end of the transition period and International Transfers. The ICO have also produced an interactive tool on using standard contractual clauses for transfers into the UK.

NICVA Brexit Articles Timeline

Share your COVID-19 support service

Organisations providing support to people and communities can share their service information here

> Share your support

Not a NICVA member yet?

Save time, money and energy. Join NICVA and you’ll be connecting in to a strong network of local organisations focused on voluntary and community activity.

Join Us

NICVA now welcomes all small groups for free.