European Data Protection Board has published Information Note on data transfers in the event of a no-deal Brexit

In the absence of an agreement between the EU and the UK, the UK will become a third country from 00.00 am CET on 30 March 2019. European Data Protection Board has published Information Note on data transfers under the GDPR in the event of a no-deal Brexit.

As a consequence of no-deal Brexit, the transfer of personal data from the EEA to the UK will have to be based on one of the instruments mentioned in the chapter V of the General Data Protection Regulation.

5 steps organisations should take to prepare for a no-deal Brexit:

• Identify what processing activities will imply a personal data transfer to the UK
• Determine the appropriate data transfer instrument for your situation
• Implement the chosen data transfer instrument to be ready for 30 March 2019
• Indicate in your internal documentation that transfers will be made to the UK
• Update your privacy notice accordingly to inform individuals

Read the Information Note on data transfers under the GDPR in the event of a no-deal Brexit (pdf)