The end of the transition period is now just over two weeks away and it is as yet unclear whether the UK will be granted data adequacy status by the EU. To ensure that personal data can flow freely from the EU/EEA to the UK from 1 January 2021, businesses should ensure that they have a Standard Contractual Clause (SCC) in place.
Personal data is any information that can be used to identify a person – including names, delivery details, IP addresses, or HR data such as payroll data. For example, a UK company that receives customer information from an EU company, such as names and addresses, to provide goods or services, should have SCCs in place.
The Department for Business, Energy and Industrial Strategy is urging businesses to take the following steps to ensure that data can continue to flow from 1 January, no matter what the UK and EU agree:
- Take stock of the personal data you process prior to 1 January 2021
- If you receive personal data from a company based in an EU/EEA country, map your data flows and put in place alternative transfer mechanisms, such as Standard Contractual Clauses (SCCs), with any relevant EU organisations (the EU has yet to make a decision as to whether they accept that the UK’s data protection regime is still adequate).
- Visit UK/using-personal-data-2021 for guidance on the actions your business or organisation needs to take regarding data protection and data flows.
Further information from Government can be found here.