Data protection for businesses after 1 January 2021

Regardless of whether the UK and the EU agree a trade deal, if a business needs to continue to receive personal data from the EU for business use, they may need to take action on data protection.

If no UK data adequacy decisions have been made by the end of the transition period, UK businesses will need to map out data flows with their EU partners and put alternative transfer mechanisms in place to continue to lawfully receive personal data from the EU. Most commonly, this will require standard contractual clauses being put in place.

Businesses will also need to familiarise themselves with the data protection provisions of the Withdrawal Agreement, to ensure they are in a position to comply.

Businesses with a European presence or European customers

If your organisation operates in the European Economic Area (EEA), the Information Commissioner’s Office (ICO) advises the following:

  • Comply with the General Data Protection Regulation (GDPR) now. The government plans to incorporate it into UK law alongside the Data Protection Act 2018 at the end of the transition period.
  • If you have any offices or other establishments in the EEA, your European activities will be covered by EU law, even at the end of the transition period. You need to check which European data protection regulator will be your lead supervisory authority.
  • If you are only based in the UK but you offer goods or services to individuals in the EEA, you will still need to comply with the EU data protection regime in relation to these activities. You may also need to appoint a suitable representative in the EEA who will act as your local representative with individuals and data protection authorities in the EEA. Read more in the ICO’s guidance to European representatives.
  • Review your privacy information and documentation to identify any minor changes that need to be made at the end of the transition period.

Further guidance

The ICO website has detailed resources on any additional steps businesses may need to take as well as an interactive Standard Contractual Clauses tool. Further guidance is also available on the gov.uk website.

For specific help and advice, call the ICO’s small business helpline on 0303 123 1113 between 9am – 5pm, Monday to Friday (excluding Bank Holidays).

A version of this blog originally appeared on the website of MHA member firm, MHA Monahans.