Information note on data transfers under the GDPR to the United Kingdom after the transition period - update 13/01/2021

Adopted 1 Information n ote on data transfers under the GDPR to the United Kingdom after the transition period Adopted on 15 December 2020 Updated on 13 January 2021 Before t he transition period for the United Kingdom’s withdrawal from the European Union end ed on 31 December 2020 , the EU and the UK reached an agreement on 24 December 2020 (the “EU - UK Trade and Cooperation Agreement” or the “Agreement” ) 1 . The Agreement was signed by the EU a nd the UK on 30 December 2020 . The EU - UK Trade and Cooperation Agreement started to apply from 1 January 2021 on a provisional basis until 28 February 2021, to provide time to the European Parliament to give its consent on the Agreement and to the Council of the EU to adopt the decision on the conclusion of the Agreement. T he EU - UK Trade and Cooperation Agreement provides that, for a specified period and upon the condition that the UK ’s current data protection regime stays in place , all transfers of persona l data between stakeholders subject to GDPR and UK entities will not be considered as transfers to a third country subject to the provisions of Chapter V GDPR 2 . This interim provision applies from the entry into force of the draft EU - UK Trade and Cooperati on Agreement for a maximum period of six months (i.e., until 30 June 2021 at the latest). This means that organisations subject to GDPR will be able to carry on transferring data to UK organisations without the need to either put in place a transfer tool u nder Article 46 GDPR or rely on an Article 49 GDPR derogation. If no adequacy decision applicable to the UK as per Article 45 GDPR is adopted by 30 June 2021 at the latest , all transfers of personal data between stakeholders subject to GDPR and UK entities will then constitute a transfer of personal data to a third country and therefore will be subject to the provisions 1 See EU - UK Trade and Cooperation Agreement, https://eur - lex.europa.eu/legal - content/EN/TXT/PDF/?uri=CELEX:22020A1231(01)&from=EN 2 See Article FINPROV.10A ‘Interim provision for transmission of personal data to the United Kingdom’, EU - UK Trade and Cooperation Agreement . See also European Commission’s Questions & Answers: EU - UK Trade and Cooperation Agreement, under the part on Securi ty, Law Enforcement and Judicial Cooperation in Criminal matters https://ec.europa.eu/commission/presscorner/detail/en/qanda_20_2532 Adopted 2 of Chapter V GDPR . Therefore, such transfers will require appropriate safeguards (e.g., standard data protection clauses, binding corporate rules 3 , codes of conduct...) with enforceable data subject rights and effective legal remedies for data subjects, in accordance with Article 46 GDPR. Subject to specific conditions, it may still be possible to transfer personal data to the UK based on a derogation listed in Article 49 GDPR . H owever, Article 49 GDPR has an exceptional nature and the derogations it contains must be interpreted restrictively and mainly relate to processing activities that are occasional and non - repetitive 4 . Moreover, where personal data will be transferred to the UK on the basis of Article 46 GDPR safeguards, supplementary measures might be necessary to bring the level of protection of the data transferred u p to the EU standard of essential equivalence , in accordance with the Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data 5 . C ontrollers and/or processors will also need to comply with other obligations deriving from the GDPR , in particular on the need to update the records of processing and privacy notices to mention transfers to the UK . The EDPB recalls the guidance provided on this matter by supervisory authorities and by the European Commission (EC) . EEA organisations may turn, if necessary, to the national supervisory authorities competent to oversee the related processing activities . For data transfers from the UK to the EEA, the EDPB would suggest regularly consulting the UK Government’s website and the ICO’s website for up - to - date guidance. For the European Data Protection Board The Chair (Andrea Jelinek) _________________________ 3 S ee EDPB information note on BCRs fo r Groups of undertakings / enterprises which have ICO as BCR Lead SA , https://edpb.europa.eu/our - work - tools/our - do cuments/other/information - note - bcrs - groups - undertakings - enterprises - which - have_en 4 See Guidelines 02/2018 on derogations of Article 49 under Regulation 2016/679 , https://edpb.europa.eu/our - work - tools/our - documents/directrices/guidelines - 22018 - derogations - article - 49 - under - regulati on_en 5 See Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data , https://edpb.europa.eu/our - work - tools/public - consultations - art - 704/2020/recommendations - 012020 - measures - supplement - transfer_en