Whilst the UK transition period ended on 31st December 2020 with no permanent agreement in place regarding ongoing EU data protection, the UK and the EU has agreed to a six-month ‘bridging mechanism’ for the continued free flow of personal data from the EU/EEA to the UK, in the mutual hope of a data processing adequacy decision in the UK’s favour. Additionally, the GDPR has been copied into UK law in the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 remains in place, binding the UK to internationally-recognised high standards of data protection.
However, if the European Commission does not make an adequacy decision regarding the UK by the end of the six-month bridging period, the UK will become a ‘Third Country’ to the EU and will be subject to increased regulatory restrictions on all data transfers from the EU/EEA to the UK.
EU partners should be given information related to the legal basis for processing and the Government have recommended standard contractual clauses, which are model data protection clauses that have been approved by the European Commission and enable the free flow of personal data when embedded in a contract.
Such standard contractual clauses have been drafted in line with that guidance (available here) and are available for all interested customers upon request.