UK data protection deemed ‘adequate’ by the EU
2nd July, 2021
On 28 June 2021, the European Commission adopted an adequacy decision in respect of the UK's data protection framework under the GDPR.
As a result, personal data can now flow from the EU to the UK freely as it did prior to Brexit, as the UK now benefits from the same level of protection available to EU member states.
This is great news for businesses as they no longer need to worry about putting in place complicated paper work to allow data flows between the UK and the EU.
Monitoring and expiry of the decisions
The European Commission will continue to monitor the UK’s data protection framework and will intervene if it considers that the UK is no longer ‘adequate’, i.e. if the UK deviates from its current standards. It is worth noting that the European Commission is able to withdraw its adequacy decisions at any time.
The decision also contains an unusual ‘sunset clause’ which means the decisions expire automatically after 4 years in any event. As such, in 2025, the European Commission will decide whether to renew the decisions, at which point it will review again the UK’s data protection framework.
What to do now
The great thing about this decision is that you need to do very little in respect of your transfers of personal data from the EU, other than to make sure your processing record (which you are obliged to maintain under Article 30 of the GDPR) states that the safeguard that you rely on for data transfers into and out of the UK from the EU is adequacy. This is welcome news if you hold personal data on a server in the EU or you process personal data for EU customers. The adoption of the adequacy decision means data transfers can continue at least until 2025 more or less as they were when the UK was within the EU.
For further information, please get in touch.
Please note that this briefing is designed to be informative, not advisory and represents our understanding of English law and practice as at the date indicated. We would always recommend that you should seek specific guidance on any particular legal issue.
This page may contain links that direct you to third party websites. We have no control over and are not responsible for the content, use by you or availability of those third party websites, for any products or services you buy through those sites or for the treatment of any personal information you provide to the third party.
