Question to the Department for Digital, Culture, Media & Sport:

To ask Her Majesty's Government which provisions of the General Data Protection Regulation will be incorporated into UK law at the end of the transition period; and what new mechanisms will be put in place to regulate future UK-to EU data transfers.

At the end of the transition period, the European Union (Withdrawal) Act 2018 (EUWA) will retain the General Data Protection Regulation in UK domestic law.

We have made Regulations (The Data Protection, Privacy and Electronic Communications (Amendments etc)(EU Exit) Regulations 2019) under the EUWA to make necessary and appropriate changes to the retained legislation so that the UK’s data protection law continues to function effectively after the transition period. For example, the Regulations rename the GDPR as the ‘UK GDPR’, repatriate certain powers from the EU Commission to the Secretary of State and replace European terminology with UK equivalents.

At the end of the transition period, the UK will recognise EEA countries and EU institutions as continuing to be adequate for the purpose of the UK GDPR, so data can continue to flow from the UK to the EEA without further safeguards needing to be implemented.

In order for the free flow of data from the EEA to the UK to continue at the end of the transition period, we are seeking adequacy decisions from the EU under both the GDPR and the LED.