If your organisation shares personal data with organisations in the European Economic Area (EEA), you will need to take steps to ensure you continue to comply with data protection laws if the UK leaves the EU without a deal. For UK businesses that only share data within the UK, there will be no change.
Personal data refers to any information that can be used to identify a living individual, including a customer’s name, their physical or IP address, or HR functions such as staff working hours and payroll details.
The UK does not intend to impose additional requirements on transfers of personal data from the UK to the EEA, therefore, organisations will be able to send personal data to organisations in the EEA as they do currently.
However, transfers of personal data from the EEA to the UK will become restricted once the UK has left the EU.
Therefore, if your organisation receives personal data from organisations in the EU you should consider, with your EEA partners, what changes you may need to make to ensure that personal data can continue to flow after the exit date.
These changes will affect organisations both large and small. To help your organisation take the right action now use the Information Commissioner’s Office’s (ICO) guidance and follow its 6 steps checklist. If you are a CECA member and would like more information, contact CECA Director of External Affairs Marie-Claude Hemming.