On January 1st, 2021, the UK formally left the EU. While much has been written on the impact Brexit will have on trade and employment rights, very little has been written about the impact of Brexit on GDPR.
As the UK has now ceased to be an EU member state, European GDPR is no longer a part of UK law. However, a UK version of GDPR was adopted on January 1st, 2021, and it is also entrenched in the Data Protection Act 2018.
“OK, but what does this mean for my business?”
Yes, we thought you’d get to that. This is where it becomes slightly more complicated. For any businesses that process personal information or share data, there will be regulations that apply, but those regulations will depend on where the information originates from.
Your business operates solely within the UK
If your business operates solely within the UK and doesn’t have any customers within the European Economic Area (EEA), UK GDPR will apply to any data that you hold. UK GDPR is basically the same as the EU GDPR, so all the same rules will apply. However, you may need to update the wording on your policies, procedures, and privacy statements.
Your business operates in the UK but has customers in the EU
If your business is based in the UK but receives and shares data in the EU, it will be affected by UK GDPR and EU GDPR. This is because the UK is counted as a ‘third country’. What this means, in reality, is that you can no longer use EU GDPR as a ‘one-stop-shop’ and will need to consider the implications of receiving fines from multiple EU member states and a UK GDPR fine should a data breach occur.
It is also worth noting that the UK currently has until June 2021 to prove ‘adequacy’. ‘Adequacy’ is a process designed to keep data flowing as freely as possible, and countries have to prove to the EU that they are a safe place for data to be stored and shared to. Without ‘adequacy’, restrictions could be imposed.
If you have any concerns over the impacts of Brexit and GDPR requirements, we recommend visiting the ICO website as they will have the most up to date information.
