Brexit and Data Transfers with the UK


On 31 January 2020, the UK formally became a third country for the purposes of EU data protection law.

brexit data transfers

Key adequacy decisions

On 28 June 2021, the European Commission (“Commission”) adopted two adequacy decisions for the United Kingdom - one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive. This means that Personal data can now flow freely from the European Union to the United Kingdom where it benefits from an essentially equivalent level of protection to that guaranteed under EU law  (without the need for additional data transfer safeguards under Article 46 of the GDPR) 

This does not remove the requirement for a data processing agreement between parties, where required, in order to comply with Article 28 of the GDPR. This is a separate and distinct obligation.

For more information, see Brexit & International Data Transfers.

Data protection guidance

For more data protection guidance and information, go to the updated new-look Data Protection section on the Law Society website.