As a result of the United Kingdom and the European Union reaching agreement on the terms of the EU-U.K. Trade and Cooperation Agreement on December 24, 2020, the U.K. and EU have agreed to continue allowing data transfers between the two for an up-to-six-month transition period. During this time, the European Commission will complete an adequacy assessment of the U.K.’s data protection laws. The adequacy assessment is a process by which the EU certifies that a country, or sector within a country, meets EU standards for data protection.

At the conclusion of the transition period, transfers of personal data between the U.K. and EU will be prohibited unless EU data are transferred to the U.K. with additional safeguards to ensure the data is adequately protected. During the transition period, which began on January 1 and ends four months later (with up to a two-month extension of the transition period, unless either the U.K. or EU objects), data transfers from the EU will be permitted without any additional safeguards required, as long as the U.K. does not change its current data protection framework.

The transition period provides the U.K. with some much-needed breathing space as it attempts to work through the implications of Brexit. Failing to reach an agreement on data transfers would have significant economic implications because of the high level of integration between the U.K. and EU. While it is anticipated that the parties will ultimately reach a long-term agreement, it is recommended that businesses that currently transfer data between the U.K. and EU put in place alternate transfer mechanisms, such as Standard Contractual Clauses, to ensure no interruption in the free flow of personal data between the EU and U.K. following the conclusion of the transition period.