At present, an ‘adequacy’ bridge agreed in the 2020 Trade and Cooperation Agreement allows for the free flow of personal data from the EU into the UK. It is set to expire on 30 June 2021.
Post-Brexit, the UK is working towards the adoption of an adequacy decision by the European Commission. In February, after nine months of assessing the UK’s domestic law and practice on personal data protection, the Commission determined that the UK does ensure essentially equivalent personal data protection to that provided under the General Data Protection Regulation (GDPR).
The next stage is for the European Data Protection Board to provide a non-binding opinion, and after taking the opinion into account, the Commission will then send the draft decision to EU Member States for formal approval: the European Commission may then adopt the decision.