It is official. The long-awaited Trade Deal between the UK and the EU is here. On page 414 of the 1256 total pages and under the fancy title of “Article FINPROV.10A: Interim provision for transmission of personal data to the United Kingdom” we can find how the hot topic of transfers of personal data from the EU to the UK is regulated.

Brexit and data transfers

So what is new one may wonder. The response is easy. Nothing. The Trade Deal provides for a limited period of time that transfers from the EU and the other EEA countries (Norway, Liechtenstein and Iceland) to the UK will not be considered transfer of personal data under the GDPR.

In practice, that means that even though the UK has exited the EU, from a data protection perspective it is not considered a third country yet. In other words, you don’t need to carry out the assessments that you have to when transferring personal data to a third country and you can do business as usual.

This specific period will last for 4 months with the possibility of a 2 months extension and is known as the “bridge”. Free flow of personal data from the EU to the UK will continue until an adequacy decision for the UK is adopted or until the bridge ends. But the bridge will end prematurely if the UK amends its current data protection legislation (UK GDPR, Data Protection Act and the PECR), or approves new standard contractual clauses, BCRs, new draft code of conducts or new certification mechanisms without the agreement of the EU.

In case the bridge ends for one of the above-mentioned reasons and lacking an adequacy decision, the UK will be a third country under the EU data protection legislations and any transfer from the EU to the UK will be subject to relevant restrictions. In other words, you will have to have additional safeguards in place, such as Standard Contractual Clauses, as well as assessments of the efficiency of the transfer tool that you will use.

So for now continue doing business as usual until further notice. Within the next following 6 months we will see the final act of the Brexit drama, which will finish either with mutual adequacy decisions or with the UK being officially a third country in regards to data protection, cutting the bonds with the EU completely.