The GDPR requirements following Brexit

Friday 29 January

Many organisations are slightly confused about the immediate GDPR requirements in the UK and the EU following the UK’s exit from the EU.

This is the situation: the so-called Free Trade Agreement makes provision for the EU to treat the UK as though it has an adequacy status in respect of data transfers from the EU for an initial period of 4 months (ie until the end of April 2021); this period can be extended with mutual agreement by a maximum of two further months.

This delay is purely to give the EU Commission breathing spaced to decide whether or not the UK should be given Adequacy status. This delay applies ONLY to data transfers – it does not apply to the requirements for EU/U representatives, and it does delay the effective date of UK GDPR, which is 1 January 2021.