European Data Protection Board has published Information Note on data transfers in the event of a no-deal Brexit
In the absence of an agreement between the EU and the UK, the UK will become a third country from 00.00 am CET on 30 March 2019. European Data Protection Board has published Information Note on data transfers under the GDPR in the event of a no-deal Brexit.
As a consequence of no-deal Brexit, the transfer of personal data from the EEA to the UK will have to be based on one of the instruments mentioned in the chapter V of the General Data Protection Regulation.
5 steps organisations should take to prepare for a no-deal Brexit:
- Identify what processing activities will imply a personal data transfer to the UK
- Determine the appropriate data transfer instrument for your situation
- Implement the chosen data transfer instrument to be ready for 30 March 2019
- Indicate in your internal documentation that transfers will be made to the UK
- Update your privacy notice accordingly to inform individuals