The Brexit transition period ended at 11pm last night. From today, the EU GDPR no longer applies directly in the UK. It has been retained in domestic law as the UK GDPR, alongside the Data Protection Act 2018.
What changes in practice?
- Day-to-day obligations for UK organisations are largely unchanged.
- Transfers from the UK to the EEA can continue freely, as the UK recognises the EEA as adequate.
- Transfers from the EU to the UK can continue for up to six months under a temporary “bridge” in the UK–EU Trade and Cooperation Agreement, while the EU considers adequacy decisions for the UK.
- UK organisations offering goods or services to, or monitoring, individuals in the EU may need an EU representative and may be subject to EU regulators too.
Review your records of processing, privacy notices and international transfer arrangements to reflect the new UK and EU positions.
Source: UK GDPR (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
