UK TRANSITION: Take action to keep data flowing legally from January 2021

08 Oct 2020

Unless a UK-EU FTA is agreed by December 2020 along with a decision from the EU that the UK’s data protection measures meet adequacy requirements, businesses will need to take extra steps to ensure that personal data can continue to be received from EU/EEA counterparts, e.g. customer information for sales purposes. It is a relatively straightforward process that may have already been covered as part of your corporate GDPR compliance but you may need to agree Standards Contractual Clauses (SSCs) with your EU/EEA counterpart companies that may be sending you such data.  More information is in this government message below but you can find the template clauses through the Information Commissioner’s Office at https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/keep-data-flowing-from-the-eea-to-the-uk-interactive-tool/


 

The UK has left the EU and the transition period will end on 31 December 2020. If you are a UK business or organisation in the third sector that receives personal data from the EU or EEA, you may need to take extra steps to ensure that the data can continue to flow legally as we transition to our new relationship with the EU in January 2021.

Visit gov.uk to check how you can legally continue to receive personal data such as names, addresses or payroll details from organisations in the EU or EEA from January 2021. You may need to update your contracts or take other steps.

What is personal data?

Personal data is any information that can be used to identify a living person.

This type of information is regularly used in the daily running of businesses and organisations – for example, in relation to human resources, sales, purchasing or marketing.

What is an example of personal data transfer from an EU/EEA partner?

  • A UK company that receives customer information from an EU/EEA company (see which countries this applies to), such as names and addresses of customers, suppliers or partners to provide goods or services.
  • It could also be internet protocol (IP) addresses or human resources data, such as staff working hours and payroll details

Businesses or organisations that receive this kind of information from an EU/EEA company to provide goods or services should check how they can legally keep receiving the data from January 2021.

Are there additional steps I need to take to help my business or organisation prepare for January 2021?

There may be additional steps you need to take to help your business or organisation prepare for January 2021.

To understand the comprehensive changes for your business, use the simple tool on gov.uk/transition to get a personalised summary of the actions you need to take...