Data exchange

What consequences does Brexit have for the protection of personal data?

Data protection

The Brexit deal of 17 December 2020 allows for the transfer of personal data to continue in the same way until 1 May 2021. This under the condition that the United Kingdom does not change it's data protection legislation. This four month period can be extended to a period of six months.

How to proceed from there depends on whether the European Commission determines that the United Kingdom has an adequate level of data protection. In absence of such an adequacy decision by the European Commission, the UK is to be considered as a so called 'third country' under the GDPR regime. This means that you should apply the Standard Contractual Clauses issued by the European Commission when personal data is transferred to the UK. As a consequence, all transfers of personal data to the UK may only be done under said Standard Contractual Clauses and corresponding conditions (e.g. inform all subject that their personal data will be transferred to the UK, a ‘third country’) should also be respected.

For further questions, please contact privacy@bb.leidenuniv.nl.