What is the impact of Brexit on international transfers of personal data?

read titleRead full title
Published on LexisPSL on 05/02/2019

The following Information Law Q&A provides comprehensive and up to date legal information covering:

  • What is the impact of Brexit on international transfers of personal data?
  • The impact of Brexit
  • Position under the draft Withdrawal Agreement
  • Position following the end of any transition period
  • Position if the UK leaves the EU in March 2019 without a transitional arrangement
  • Further guidance

This Q&A looks at the impact of Brexit on cross-border transfers of personal data involving the UK and EEA, under the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR). It does not address cross-border transfers of personal data by competent authorities for law enforcement purposes or by the intelligence services, and under the ‘applied GDPR’ regime, which are beyond the scope of this Q&A.

Since 25 May 2018, the GDPR has been directly applicable in the UK and all other EU Member States. The GDPR regime has also been incorporated in the EEA Agreement and governs the processing of personal data across the EEA (the EU plus Iceland, Norway, and Liechtenstein).

The GDPR regime permits EEA states to introduce certain national derogations. In the UK those have been implemented by the Data Protection Act 2018, see Practice Note: The Data Protection Act 2018.

Chapter V of the GDPR regime imposes a restriction which prevents personal data from being transferred to ‘third countries’ outside the EEA. These transfer restrictions apply unless one of the following transfer mechanisms are in place:

  1. the transfer is covered by a relevant adequacy decision issued by the European Commission (the Commission)

  2. appropriate safeguards are in place

  3. certain limited derogations apply

At present, personal data may be transferred between the UK and the rest of the EEA without needing to comply with particular transfer restrictions

Popular documents