Skip to main content

Cookies

We use cookies to help provide a better website experience for you, as well as to understand how people use our website and to provide relevant advertising.

By clicking "I agree", you'll be letting us use cookies to improve your website experience. To find out more or to change your cookie preferences, click "Manage Cookies".

We value your privacy

Like many other websites, our website uses cookies. Cookies are small files placed on your computer when you visit our site. They serve a number of purposes, including ensuring that certain parts of the website work properly, allowing us to understand which areas of our website are the most popular and allowing us to provide more relevant advertising messages. They don't allow us to identify you specifically and no personal data is gathered about you.

If you'd prefer that cookies weren't placed on your computer when you visit our site, you can use the controls below to allow or disallow different types of cookie. Some cookies are essential for the website to work, so they can't be disallowed.

  • These cookies give us anonymised information on how people use our website. We use these cookies to help us tailor our site to meet the needs of our visitors, for example by making sure our most popular pages are easy to find.

  • These cookies serve a number of purposes, such as allowing you to share our content with your friends and social networks. We also use these cookies to provide targeted advertising, so you may see relevant adverts based on the pages you look at on our website.

  • About
  • News & Insights
  • Careers
  • International
  • ESG
0370 1500 100
Dialog that contains search functionality
Irwin Mitchell Logo
  • Personal
    • Personal
    • Personal Home
    • Personal Injury Claims
      • Personal Injury Claims
      • Personal Injury Claims Home
      • Abuse & Criminal Injury Claims
      • Accidents In Public Places Claims
      • Accident At Work Claims
      • Air, Rail & Maritime Claims
      • Asbestos & Mesothelioma Claims
      • Changing Solicitors During a Personal Injury Claim
      • Group Claims
      • Holiday Accidents & Illness Claims
      • Illness Compensation Claims
      • Industrial Disease Claims
      • Injury Types
      • Military Injury Compensation Claims
      • No Win No Fee Personal Injury Claims
      • Personal Injury Claims In Scotland
      • Personal Injury Information
      • How To Claim Compensation For Personal Injury
      • Product Liability Claims
      • Rehabilitation & Medical Care
      • Road Traffic Accident Claims
      • Serious Injury Claims
      • Who Can Help?
      • Support Services
    • Medical Negligence Claims
      • Medical Negligence Claims
      • Medical Negligence Claims Home
      • Cancer Misdiagnosis Claims
      • Birth Injury Claims
      • Cauda Equina Syndrome Claims
      • Cosmetic Surgery Claims
      • Cerebral Palsy Claims
      • Defective Medical Device Claims
      • Dental Negligence Claims
      • Diabetes Claims
      • Fatal Medical Negligence Claims & Inquests
      • GP Negligence Claims
      • Hospital Negligence Claims
      • What Is Medical Negligence?
      • Meningitis Misdiagnosis Claims
      • Failure To Prevent Suicide Claims
      • Misdiagnosis Claims
      • Ophthalmic Negligence Claims
      • Pregnancy & Gynaecology Injury Claims
      • Sepsis Negligence Claims
      • Shrewsbury & Telford Hospital NHS Trust Maternity Care Claims
      • Stroke Misdiagnosis Claims
      • Surgery Compensation Claims
    • Family Law
      • Family Law
      • Family Law Home
      • Divorce Solicitors
      • Prenuptial & Postnuptial Agreement Solicitors
      • Child Abduction Solicitors
      • Civil Partnership Solicitors
      • LGBT+ Family Law Solicitors
      • Unmarried Couples' Rights
      • Divorce Financial Settlement Solicitors
      • Child Arrangement Orders
      • Family Mediation Lawyers
      • Out Of Court Divorce Solicitors
      • Separation Agreement Solicitors
      • Adoption & Surrogacy Solicitors
      • Counselling
    • Wills, Trusts & Estates
      • Wills, Trusts & Estates
      • Wills, Trusts & Estates Home
      • Estate Planning Solicitors
      • Powers Of Attorney
      • Trusts
      • Will Writing Services
      • Will Disputes & Contentious Probate
    • Conveyancing & Property Solicitors
      • Conveyancing & Property Solicitors
      • Conveyancing & Property Solicitors Home
      • Conveyancing Fees Calculator
      • Buying A Property
      • Selling A Property
      • Remortgage
      • Transfer Of Equity
      • Buy To Let
      • Absentee Landlord & Freeholder Tracing Service
      • Freehold Purchase (Leasehold Enfranchisement) Solicitors
      • Lease Extension Solicitors
      • Conveyancing Guide
      • Our Prices - Residential Conveyancing for properties valued above £500,000
    • Tax
      • Tax
      • Tax Home
      • Business Tax
      • Inheritance Tax
      • International Tax
      • Professional Negligence
      • HMRC Tax Investigations
      • Tax Disputes & Litigation
      • Tax Residence
      • Tax Returns & Compliance
      • Wealth Structuring
    • Probate
      • Probate
      • Probate Home
      • International Probate
      • Probate Sale Conveyancing
      • What Is Probate & How Does It Work?
    • Will, Trust & Estate Disputes
      • Will, Trust & Estate Disputes
      • Will, Trust & Estate Disputes Home
      • Trust Disputes
      • Inheritance Act Claims
      • Contesting A Will
      • Contentious Probate
      • Pre-Death Agreements
      • Professional Negligence
      • Challenging A Lifetime Gift
      • Financial Abuse
      • Statutory Will Disputes
      • Defending A Contested Will
    • Employment Solicitors
      • Employment Solicitors
      • Employment Solicitors Home
      • Employment Contract Solicitors
      • Employment Disputes
      • Dismissal & Redundancy Solicitors
      • Employment Discrimination Solicitors
      • Employment Lawyers for Legal Expenses Insurance
      • Harassment & Bullying At Work Solicitors
      • Parental & Family Friendly Employment Rights
      • Professional Discipline Solicitors
      • Recruitment & Promotion
      • Senior Executive Employment Lawyers
      • Settlement Agreements
      • Whistleblowing Solicitors
    • Elderly Legal Services
    • Protecting Your Rights
      • Protecting Your Rights
      • Protecting Your Rights Home
      • Actions Against The Police
      • Environmental & Planning Law
      • Assessment & Treatment Unit Solicitors
      • Data Protection Breach Claims
      • Education Law
      • Healthcare & Social Services
      • Human Rights
      • Judicial Review
      • Mental Capacity
      • Motoring Offences Legal Advice
      • Professional Regulation & Discipline
      • Dispute Resolution
      • Legal Aid
    • Immigration Solicitors
      • Immigration Solicitors
      • Immigration Solicitors Home
      • British Citizenship & Naturalisation Solicitors
      • EU & EEA Immigration Solicitors
      • Indefinite Leave To Remain Solicitors
      • Spouse Visa Solicitors
      • Innovator Visa
      • Tier 1 Entrepreneur Visa
      • Permanent Residence Solicitors
      • Tier 1 Investor Visa
      • Business Immigration Solicitors
    • Crime & Investigations
      • Crime & Investigations
      • Crime & Investigations Home
      • Crime
      • Fraud & Financial Crime
      • Court Martial Solicitors
      • Motoring Offences Legal Advice
      • Regulatory Investigations & Enforcement
    • Insolvency
      • Insolvency
      • Insolvency Home
      • Business Restructuring & Insolvency
      • Debt Consultancy
      • Insolvency Disputes & Litigation
    • Court Of Protection
      • Court Of Protection
      • Court Of Protection Home
      • Court Of Protection Deputyship
      • Personal Injury Trusts
      • Court Of Protection Problems & Disputes
      • Healthcare and Social Services
      • Frequently Asked Questions
      • Powers Of Attorney
      • Powers Of Attorney Disputes
      • Statutory Wills And Trusts
    • Agriculture & Rural Business
    • Landed Estates
    • Family Offices
  • Wealth Management
    • Wealth Management
    • Wealth Management Home
    • Asset Management For Personal Injury
    • Charity & Philanthropy
    • Estate Planning
    • Ethical & Sustainable Investing
    • Financial Planning
    • Intergenerational Wealth Management
    • Investment Management
    • Retirement Financial Planning
    • Succession Planning
    • Tax Planning
  • Business
    • Business
    • Business Home
    • Sectors
      • Sectors
      • Sectors Home
      • Agriculture & Rural Business
      • Consumer & Retail
      • Education
      • Financial & Professional Services
      • Landed Estates
      • Manufacturing
      • Media & Entertainment
      • Real Estate
      • Sport
      • Technology & Communications
    • Banking & Finance
      • Banking & Finance
      • Banking & Finance Home
      • Corporate Banking
      • Funds
      • Leveraged & Acquisition Finance
      • Real Estate Finance
      • Receivables Finance & Asset Based Lending
    • Business Crime
      • Business Crime
      • Business Crime Home
      • Anti-Bribery & Corruption
      • Asset Tracing & Recovery
      • Cartels & Illegal Price Fixing
      • Cybercrime
      • Dawn Raids
      • Deferred Prosecution Agreements
      • Extradition
      • INTERPOL Red Notices
      • Mutual Legal Assistance
      • Private Prosecution
      • Proceeds Of Crime Act
      • Unexplained Wealth Orders
      • Fraud Lawyers
      • Insider Trading & Market Abuse
      • Corporate Internal Investigations
    • Business Immigration
      • Business Immigration
      • Business Immigration Home
      • Business Visitor Visa
      • Innovator Visa
      • Prevention Of Illegal Working
      • Sole Representative Of An Overseas Business
      • Tier 1 Entrepreneur Visa
      • Tier 1 Investor Visa
      • Tier 2 & 5 Sponsor Licence
      • Tier 2 Visa
      • Tier 4 Sponsor Licence
    • Commercial
      • Commercial
      • Commercial Home
      • Commercial Contracts
      • Competition Law
      • GDPR & Data Protection
      • Information Technology
      • Media & Entertainment
      • Sourcing
      • Licensing
      • Notary Public Solicitors
    • Commercial Litigation & Dispute Resolution
      • Commercial Litigation & Dispute Resolution
      • Commercial Litigation & Dispute Resolution Home
      • Banking & Finance Litigation
      • Business Interruption Insurance Lawyers
      • Contract Disputes
      • Commercial Judicial Review
      • Defamation & Reputation Management
      • International & Cross-Border Disputes
      • Litigation Funding
      • Our Prices - Commercial Debt Recovery
      • Professional Negligence
    • Corporate
      • Corporate
      • Corporate Home
      • Corporate Advisory
      • Equity Capital Markets
      • Mergers & Acquisitions (M&A)
      • Private Equity
    • Costs Team
    • Environmental, Social & Governance
      • Environmental, Social & Governance
      • Environmental, Social & Governance Home
      • Environment
      • Social
      • Governance
      • International
      • ESG Legal Advisory Services
      • Cyber Security
      • Diversity & Inclusion
      • Legislation Library
      • ESG Media Library
      • Sports Sector
      • Manufacturing Sector
      • Real Estate Sector
      • Consumer & Retail Sector
    • Employment Law
      • Employment Law
      • Employment Law Home
      • Business Immigration
      • Employment Contracts, Policies & Procedures
      • Disciplinary & Grievance
      • Employee & Industrial Relations
      • Employment Lawyers for Legal Expenses Insurance
      • Employment Litigation & Dispute Resolution
      • Equality, Diversity & Discrimination
      • Flexible Working Arrangements
      • Health & Safety
      • HR Advice Service - IMhrplus
      • Managing Sickness Absence
      • Pensions
      • Recruitment
      • Restrictive Covenants
      • Restructuring & Redundancy
      • Self Employment, Contractors & Agency Workers
      • Employment Seminars, Training & Updates
      • TUPE
    • In-House Counsel
    • Intellectual Property
      • Intellectual Property
      • Intellectual Property Home
      • Defamation & Reputation Management
      • Copyright Lawyers
      • Design Rights Lawyers
      • Image Rights Lawyers
      • IP Audits
      • Online Marketplace Seller Account Or Listing Suspensions
      • Stopping IP Infringement By Sellers On Online Marketplaces
      • Patent Lawyers
      • Trade Mark Lawyers
      • Trade Secrets Lawyers
    • Legal Helpline
    • Pensions
      • Pensions
      • Pensions Home
      • Employment
      • Managing Death Benefit Trusts
    • Regulatory & Compliance
      • Regulatory & Compliance
      • Regulatory & Compliance Home
      • Road Transport & Operator Compliance
      • GDPR & Data Protection
      • Regulatory Investigations
      • Environment & Safety Regulatory Compliance
      • Financial Services Regulation
    • Real Estate
      • Real Estate
      • Real Estate Home
      • Corporate Occupiers
      • Real Estate Development and Regeneration
      • Construction & Engineering
      • Environmental
      • Real Estate Finance
      • Real Estate Investment
      • Later Living & Care
      • Planning
      • Property Litigation & Real Estate Disputes
      • Real Estate Tax
      • Residential Development
      • Strategic Land
      • Structured Real Estate
    • Restructuring & Insolvency
      • Restructuring & Insolvency
      • Restructuring & Insolvency Home
      • Corporate Insolvency
      • Partnership Insolvency
      • Directors' Duties
      • Restructuring Plans
      • Restructuring
    • Tax
      • Tax
      • Tax Home
      • Corporate Tax
      • Real Estate Tax
      • Tax Investigations
  • People
    • People
    • People Home
    • Search By Name
    • Search By Location
    • Search By Expertise
    • Business Management
  • Offices
    • Offices
    • Offices Home
    • Birmingham
    • Bristol
    • Cambridge
    • Cardiff
    • Chichester
    • Gatwick
    • Glasgow
    • Leeds
    • Liverpool
    • London
    • Manchester
    • Middlesbrough
    • Newbury
    • Newcastle
    • Reading
    • Sheffield
    • Southampton
  • Contact
  • About
  • News & Insights
  • Careers
  • International
  • ESG
Irwin Mitchell Logo
Dialog with Irwin Mitchell phone number
Call us on 0370 1500 100

We're here 24/7, 365 days a year.

  • Home
  • News & Insights
  • In Focus
  • Data Protection & GDPR

Data Protection & GDPR

The value of the data economy in the EU and UK in 2020 was 440 billion euros according to the EU Commission. Data is therefore a key part of the economy and formed an important part of the Brexit negotiations between the UK and the EU.

The UK Government were keen to ensure that personal data could continue to flow between the EU and the UK, and some breathing space on this issue was achieved in the Trade and Cooperation Agreement (the “TCA”) reached between the UK and the EU in December 2020.

While data protection was on the agenda in the Brexit negotiations, it wasn’t something that many businesses thought about as part of their Brexit planning. Even though the TCA has been agreed, it doesn’t deal with all aspects of data protection compliance relating to the UK leaving the EU, and there are some important aspects which all businesses need to consider as part of their Brexit planning.

We’ve highlighted below the three main questions we get from clients on this subject, or you can read on for information on the wide range of issues that you need to consider:

  • Can we still send personal data to the EEA?
  • Can we still get personal data from the EEA into the UK?
  • Do I need a Data Protection representative in the EEA?

You can also watch recordings of webinars that our experts have hosted about Brexit and GDPR:

  • Impact of the Brexit Deal on GDPR & Data Protection
  • Schrems II, GDPR and Brexit: are you prepared?

Is the GDPR still in force?

Following the end of the transition period (31 December 2020) the ‘UK GDPR’, which is almost identical to the EU GDPR, is now in force. Businesses established in the UK must comply with the UK GDPR, together with some businesses outside of the UK. 

The EU GDPR may also continue to apply to UK businesses. If a UK business still has an establishment in the EU then that business will be subject to the EU GDPR. The EU GDPR also has extra-territorial effect, which means that if a UK business outside the EEA continues to sell goods or services to individuals in the EEA, or monitors their behaviour, then they will be subject to the EU GDPR as well as the UK GDPR. ‘Monitoring’ is a broad concept which includes dropping cookies on a website and using them to profile customers in the EEA, using CCTV in the EEA, or carrying out market surveys in the EEA.

A UK business can therefore be subject to both the UK GDPR and the EU GDPR.

Regardless of whether you’re subject to the UK GDPR or the EU GDPR, your obligations will be almost identical. Any GDPR readiness project and associated documentation will still be relevant (subject to some fairly minor changes which we cover below).

Can we still send personal data to the EEA?

The UK Government has confirmed that for now, businesses can still send personal data from the UK to organisations in the EEA without any additional formalities. The position is the same as pre-Brexit, although the UK Government has said that it will keep this under review.

Can we still send personal data to countries with an existing adequacy decision?

The European Commission found that a number of countries provide sufficient protection for personal data that they are deemed ‘adequate’. These countries are: Argentina, Uruguay, Jersey, Guernsey, Isle of Man, Andorra, Switzerland, Israel, New Zealand, Canada (businesses caught by Canadian data protection legislation), and Japan (private sector organisations).

This means that personal data can be sent to these countries without any additional formality. These adequacy decisions will continue after the end of the transition period, so UK businesses can continue to send personal data to those countries in the same way as before. The UK Government will also keep this under review.

What about sending personal data to countries outside the EEA without an adequacy decision?

The position will be the same as before the end of the transition period. This includes sending personal data to the US. You should be aware, however, that in the middle of July 2020, a European Court decision held that the Privacy Shield (relevant to US export) was invalidated, and further due diligence is needed before standard export clauses can be used.

Can we still get personal data from the EEA into the UK?

The ability for UK businesses to continue to bring personal data into the UK is a key issue, particularly with the increasing globalisation of business. The UK is now outside the EEA, and so the provisions in the GDPR that allow personal data to be sent around the EEA without any additional formality no longer apply.

The UK Government has said for some time that it wants an adequacy decision from the EU (for example, like New Zealand or Israel). While this hasn’t been agreed in the TCA it is in progress, and an adequacy assessment is currently being carried out.

While the adequacy assessment takes place, the TCA provides some breathing space for UK businesses as it agrees that personal data can continue to be sent from the EEA to the UK for up to six months (until the end of June 2021).

It is intended that an adequacy decision will be reached during that 6-month period but this is not guaranteed. While the ICO welcomes the fact that a deal has been done, they have taken a cautious approach in suggesting that until adequacy has been agreed, businesses should consider whether to put in place standard contractual clauses or other mechanisms to legitimise the export of personal data. This is probably premature at the moment and we would suggest waiting to see how the adequacy negotiations unfold.

Do I need a representative in the EEA?

If you’re caught by the extra-territorial jurisdiction of EU GDPR (see question 1), you now need to appoint a representative in the EEA unless you fall within the exemption. The exemption provides that you don’t need to appoint a representative where:

  • you are a public authority; or
  • your processing is only occasional, of low risk to the data protection rights of individuals, and does not involve the large-scale use of special category data (e.g. health data, and data relating to ethnic origin, race, religious beliefs or political beliefs) or criminal offence data.

Your representative can be an individual or a company, but must be appointed in writing. They can be a group company, which is a popular option where the group has an establishment in the EEA. However, you should bear in mind that since they are representing you in relation to your EU GDPR compliance, the group company must be able to fulfil their responsibilities in this regard (e.g. by maintaining records of processing etc.). In view of this requirement, EEA-based lawyers are another popular choice.

Your appointed representative is required to deal with individuals in the EEA on your behalf, and also any EEA regulator. You therefore need to include their details in your privacy notice so that an individual in the EEA, who wants to make a subject access request to you, can send it to your representative.

Since your representative is there to deal with EEA individuals whose data you process, they should be based in an EEA country where at least some of those individuals are based.

The current intention of the UK Government is to operate an equivalent regime in relation to the UK GDPR, so that businesses outside the UK caught by its extra-territorial effect will need a UK representative.

Our flowchart will help you work out if you need to appoint a representative - download the PDF

Is there anything else to think about?

You may need to update your documentation. UK businesses that are subject to the EU GDPR may need to update their privacy notices if they are required to appoint a representative or get any personal data sent to them from the EEA.

Also, UK businesses will need to update any references to EU law in privacy notices or other GDPR documentation. You’ll also need to think about Article 30 registers and if you are caught by EU GDPR, you may need to review your legal basis to process data as “compliance with law” under EU GDPR can only apply to EU law, or the laws of a member state.

Following the end of the Brexit transition period, UK businesses no longer benefit from the ‘one-stop-shop’ and so if your business is caught by EU GDPR you may have to deal with both the ICO and other EEA regulators if there is an issue.

You may find the ICO’s website and FAQs helpful. 


See our GDPR and Data Protection section for more information about how our lawyers can help your business with the issues covered on this page.

Contact us today

To talk about your situation

Freephone

0370 1500 100

Prefer not to call?

Use our form

This data will only be used by Irwin Mitchell for processing your query and for no other purpose.

About Irwin Mitchell

Founded in Sheffield in 1912, Irwin Mitchell has always been a bit different. Our advisers really get to know the people and business that we help.

It's what we call 'expert hand, human touch'.

We have offices around the UK so wherever you are, our experts can help.

Contact Us

Give us a ring to speak to a member of our team in the strictest confidence. Or you can fill out our contact form and we'll ring you back.

0370 1500 100

Our phone lines are open 24/7, 365 days a year

Get a call back

Fill in your details below and we'll be in touch as soon as possible

This data will only be used by Irwin Mitchell for processing your query and for no other purpose.

  • Contact
  • 0370 1500 100
  • Contact Irwin Mitchell
  • Social Media
  • Twitter
  • Facebook
  • YouTube
  • LinkedIn
  • Instagram
  • About Irwin Mitchell
  • About Us
  • Social Responsibility
  • Careers
  • Business Management
  • Alumni Programme
  • SRA Regulated
  • Terms & Conditions
  • Accessibility
  • Privacy & Security
  • Hoaxes
  • Modern Slavery Act Statement 2021
  • Manage Cookie Settings

© 2023  Irwin Mitchell LLP

Irwin Mitchell LLP is authorised & regulated by the Solicitors Regulation Authority. Our Regulatory Information

Dialog that contains a form to request a callback.

Request A Callback

Enter you details below and we'll call you back, at a time of your choice

Preferred date*
Today
Tomorrow

This data will only be used by Irwin Mitchell for processing your query and for no other purpose.