If the UK leaves the EU without a deal and you are a small or medium-sized business or organisation based in the UK that needs to maintain the free flow of personal data into the UK from Europe, you will need to take some action.
Putting in place a contract between you and the sender on EU-approved terms, known as standard contractual clauses (SCCs) will be sufficient in most cases. The contract needs to be in place before the date that the UK leaves the EU without a deal.
If you receive personal data into the UK from the EEA (the EU plus Iceland, Liechtenstein and Norway), you need to:
- decide whether standard contractual clauses (SCCs) can help you maintain the flow of data
- select the right SCCs.
- understand the SCCs.
- complete the SCCs.
The ICO has produced an interactive tool to help with these steps.
If you are a larger organisation or multinational company, a data protection professional, or you already have well-established transfer mechanisms, the Information Commissioners Office (ICO) has specific guidance on leaving the EU and on international transfers on their website.