How does Brexit affect me as a EU/EEA-based business?
Data transfers to the UK
The Brexit agreement struck by the EU and UK in December 2020 includes a transition period of 4 months expiring on April 30th, 2021, which could be extended by another 2 months: during that period, the UK will not be regarded as a “third country”.
→ Until then, nothing changes for EU/EEA businesses transferring data to the UK.
Once the transition period expires (i.e. not before Apr. 30th 2021), data transfers to the UK must take place according to the general GDPR principles, i.e.:
in case the European Commission should issue an adequacy decision for the UK, data transfers could take place without additional requirements;
in case no adequacy decision is issued before the end of the extended transition period, transfers of personal data from the EU/EEA states towards the UK will have to rely on appropriate safeguards such as standard contractual clauses approved by the European Commission (SCCs), or other “appropriate safeguards” or “exceptions” for transfer set forth in the GDPR.
Data protection representative
As of now, the UK-GDPR requires entities that process the personal data of natural persons in the UK to appoint a representative in the UK. Right now, during the transition period, this requirement does not yet apply to EU/EEA entities.
However, after the transition period expires, EU/EEA businesses processing data of natural persons in the UK will most likely have to appoint a UK representative.