Question to the Department for Digital, Culture, Media & Sport:

To ask Her Majesty's Government whether the EU’s General Data Protection Regulations will apply to companies operating in the UK after the end of the transition period for the UK’s departure from the EU; and if so, what plans they have to inform such companies of the implications.

During the transition period (until 31 December) there is no change to the current data protection regime, and the General Data Protection Regulation (GDPR) will continue to apply.

At the end of the transition period, the European Union (Withdrawal) Act 2018 (EUWA) will retain the GDPR in UK domestic law, while the legislation implementing the Law Enforcement Directive (LED) (Part 3 of the Data Protection Act 2018) will also be preserved.

We have made Regulations under the EUWA to make necessary and appropriate changes to the retained legislation so that the UK’s data protection law continues to function effectively after the transition period. This will mean that the UK continues to have the same high data protection standards.

The UK has legislated to allow for the free flow of personal data to continue to the EU/EEA, Gibraltar and third countries currently in receipt of EU adequacy decisions at the end of the transition period. We are also seeking EU data adequacy decisions under both the GDPR and the LED, which would allow for the continued free flow of data to the UK. However, if the UK does not have these adequacy decisions in place at the end of the transition period, organisations will need to put in place alternative transfer mechanisms to allow for the continued lawful transfer of personal data from the EU/EEA to the UK.

Guidance can be found on GOV.UK and the ICO website regarding steps organisations may be required to take relating to data protection and data flows by the end of the transition period.