Guidance to help businesses and charities continue to comply with data protection law after 29 March.
Published 28 January 2019
From:
Department for Digital, Culture, Media & Sport, Office for Civil Society, and Department for Exiting the European Union
If your organisation shares personal data with organisations in the European Economic Area (EEA), you will need to take steps to ensure you continue to comply with data protection laws if the UK leaves the EU without a deal. For UK businesses that only share data within the UK, there will be no change.
If your organisation shares personal data with organisations in the European Economic Area (EEA), you will need to take steps to ensure you continue to comply with data protection laws if the UK leaves the EU without a deal. For UK businesses that only share data within the UK, there will be no change.
Personal data refers to any information that can be used to identify a living individual, including a customer’s name, their physical or IP address, or HR functions such as staff working hours and payroll details.
The UK does not intend to impose additional requirements on transfers of personal data from the UK to the EEA, therefore, organisations will be able to send personal data to organisations in the EEA as they do currently.
However, transfers of personal data from the EEA to the UK will become restricted once the UK has left the EU.
Therefore, if your organisation receives personal data from organisations in the EU you should consider, with your EEA partners, what changes you may need to make to ensure that personal data can continue to flow after the exit date.
These changes will affect organisations both large and small. To help your organisation take the right action now use the Information Commissioner’s Office’s (ICO) guidance and follow its 6 steps checklist.
Further information
• 7 questions to get guidance relevant to your business when the UK leaves the EU
• ICO Guidance and resources for organisations after Brexit
• General Data Protection Regulation (GDPR) guidance
