[Information correct at 18 December 2020]
Alongside (but separate to) the UK’s Free Trade Agreement negotiations with the EU, both sides are also negotiating on Data. We would therefore like to remind you of the following information:
Steps your business needs to take:
- You should take stock of the personal data you hold prior to January 2021
- If you receive data from the EU/EEA, you should map your data flows and put in place alternative transfer mechanisms with any relevant EU organisations.
- You can put in place safeguards by incorporating standard contractual clauses. Search ‘keep data flowing’ on the ICO’s website for more help or look on their site here.
Personal data provisions in the Withdrawal Agreement
- Without adequacy decisions in place, the personal data protection provisions of the Withdrawal Agreement will come into effect. These require certain ‘legacy’ personal data you may hold to be protected in line with EU data law (in its end of transition period state).
- Legacy data comprises personal data of individuals outside the UK (whether in the EEA or not) processed in the UK before the end of the transition period or subsequently on the basis of the Withdrawal Agreement.
- You will need to familiarise yourself with these requirements to ensure you are in a position to comply.
Further Guidance
- Visit the GOV.UK guidance on using personal data in your business or other organisations after the transition period.
- Visit the ICO guidance, including an interactive Standard Contractual Clauses (SCC) tool, or call the helpline on 0303 123 1113.
GOV.UK will be kept up to date at all times and we would encourage you to continue to check here to find information on what the forthcoming outcome of data negotiations will mean for your business.