The end of the transition period – what has changed?
The UK left the European Union on 31^st January 2020 and entered a transition period, which ended on 31^st December 2020. What does this mean for data protection and your business?

In short, the data protection principles set out in the EU General Data Protection Regulation (“EU GDPR”) and the Data Protection Act 2018 (“DPA”) will remain in place, with fundamental rights and obligations, such as accountability and transparency, continuing to apply. The EU GDPR is retained in domestic law and the “UK GDPR” sits alongside an amended version of the DPA.

The transfer of personal data by UK businesses to the European Economic Area (“EEA”) will remain largely unchanged and can continue without any additional protections being put in place. What may change is the basis on which UK businesses receive personal data from the EEA.

The UK and the EU agreed a four month “grace-period” from 1^st January 2021, at the end of which the UK could be regarded as a “third country” under the EU GDPR. At the time of writing, the UK Government is seeking an adequacy decision from the European Commission, allowing the flow of personal data from the EEA to the UK to continue without any additional safeguards being required. In the absence of such adequacy decision, transfers from the EEA to the UK will need to comply with EU GDPR transfer restrictions.

This is a fast-moving area and the Information Commissioner’s Office (“ICO”) has confirmed it will keep its guidance under review and update it as the situation evolves.

What does this mean for my business?
If you are a UK-based business or organisation, and you transfer personal data to or from other countries (including European countries), you should consider the following steps:

• Understand and record your international flows of personal data, focusing mainly on transfers from the EEA to the UK. Note the definition of “personal data” captures all information that relates to an identified or identifiable individual.
• Whilst you should consider all transfers, you may look to prioritise transfers of large volumes of data, transfers of special category data, and your business-critical transfers.