Brexit Data Protection: action needed to continue with transfers of personal data from EU to UK after 31 December 2020 and from UK/EU to other jurisdictions

post-Brexit transition period due to end on 31 December, as well as recent developments that have a significant impact on transfers of personal data from the UK/EU to other jurisdictions, we wanted to alert you that there are likely to be additional legal compliance steps that you should be taking now with regard to:

• any sharing of personal data from the EEA to the UK
• any sharing of personal data from the UK/EEA to other jurisdictions
• record keeping and consideration of UK and/or EEA representative requirements

The UK – Personal data of UK data subjects only

The UK GDPR is very similar to the existing EU GDPR. Therefore, businesses in the UK that are collecting and processing data of UK data subjects in compliance with the existing legislation are unlikely to need to make significant changes to prepare for the end of the transition period.

The UK, Personal data of EU27 data subjects
Businesses that are based in the UK and process data of EU27 data subjects will now be bound by the EU GDPR by virtue of its extra-territorial effect to such UK businesses, rather than directly.