Find out more about the impact of Brexit on data exchange.
Uncertainty exists with regard to personal data now protected under the GDPR (AVG). The draft deal provides for continued personal data protection under the GDPR principles beyond Brexit day, for the duration of the Brexit deal. Without a deal, the UK should also be expected to adhere to the GDPR after Brexit given that the UK has confirmed that their privacy regime will respect the GDPR principles in a post Brexit era.
However, we recommend that contracts involving the transfer of personal data to institutions or companies in the UK be checked by the Data Protection Officer or Privacy Officer for the following reason.
In absence of an adequacy decision by the European Commission, the UK is to be considered as a so called 'third country' under the GDPR regime if the Brexit is executed without a deal. This means that you should apply the Standard Contractual Clauses issued by the European Commission when personal data is transferred to the UK. As a consequence, all transfers of personal data to the UK may only be done under said Standard Contractual Clauses and corresponding conditions (e.g.inform all subject that their personal data will be transferred to the UK, a ‘third country’) should also be respected.
For further questions, please contact firstname.lastname@example.org.