Using Personal Data & Data Protection after 1 January 2021

Regardless of whether the UK and the EU agree a trade deal, if a business needs to continue to receive personal data from the EU for business use, they may need to take action on data protection.

If no UK data adequacy decisions have been made by the end of the transition period, UK businesses will need to map out data flows with their EU partners and put alternative transfer mechanisms in place to continue to lawfully receive personal data from the EU. Most commonly, this will require standard contractual clauses being put in place.

Businesses will also need to familiarise themselves with the data protection provisions of the Withdrawal Agreement, to ensure they are in a position to comply.

Refer to the Information Commissioner’s Office (ICO) website as they have detailed guidance on any additional steps businesses may need to take and an interactive Standard Contractual Clauses tool to use.

Further guidance is available online by searching for ‘using personal data from 2021’ on the GOV.UK website.