Ready for No deal Brexit?

Preparing for No Deal Brexit - Data protection and transfers. Use this cheat-sheet to determine if you need to take action to be ready for 31 October.

Do you process personal data of EU data subjects/citizens?

No. No further action required.

Yes

Action required.

1. You may need to assign a new “lead authority” based in the EU country where you carry out your main business activities in addition to the ICO.

2. Designate an EU and UK representative.

Do you require a DPO to supervise your data processing activities?

Yes, your core activities require large scale and systemic handling of personal data

Yes, your core activities consist of processing special category personal data

Action required:

1. If required, appoint an EU based Data Protection Officer (DPO).

Do you transfer UK data subjects/citizens personal data from UK to EU?

Action required:

No further action required. UK to make transitional EU adequacy determination.

Do you import EU data subjects/citizens personal data to UK?

No No further action required.

Yes

Action required.

1. Identify what processing activities will imply a personal data transfer to the UK

2. Determine the appropriate data transfer instrument

3. Implement the chosen data transfer instrument to be ready for “Brexit” date. Update contracts with EU standard clauses, Binding corporate rules (BCR) and/or updated consent requirements.

4. Update internal documentation to reflect that transfers will be made from EEA to the UK

5. Update your privacy notice accordingly to inform the individuals

If a transition withdrawal agreement is reached, the UK will process data under EU law until the end of transition period meaning new transfer mechanisms not needed immediately.

Contact us for a consultation and more information.