Insights European Data Protection Board updates its Statement on the withdrawal of the UK from the EU


The EDPB has updated the Statement that it originally published on 15 December 2020 on the UK’s withdrawal from the EU. The Statement reflects the agreement reached between the EU and the UK on 24 December 2020, the Trade and Cooperation Agreement (TCA), which provisionally came into force on 1 January 2021 until 28 February 2021, pending ratification by the European Parliament and the Council of the EU.

The Statement notes that the TCA provides that for a maximum period of six months from its entry into force, i.e. until 30 June 2021 at the latest, and upon the condition that the UK’s current data protection regime stays in place, all data flows of personal data between stakeholders subject to the GDPR (i.e. in EU Member States) and UK organisations will not be considered as transfers to a third country.

This means, the EDPB states, that organisations subject to the GDPR will be able to carry on transmitting data to UK organisations without the need to either put in place a transfer tool under Article 46 of the GDPR or rely on an Article 49 of the GDPR derogation. Specific guidance can be found on the EDPB website. To read the updated Statement, click here.