The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

The GDPR primarily applies to controllers and processors (with some exceptions) in the European Economic Area (EEA). The UK has left the EU and is now in a transition period until 31 December 2020. Once the transition period ends the UK will become a third country. Third countries are states that fall outside of the GDPR zone (EU member states plus Norway, Liechtenstein and Iceland). The GDPR restricts transfers of personal data to third countries, unless personal data is protected in another way or an exception applies. Please see our guidance on International Transfers for more information.

The European Commission has the power to determine whether a third country has an adequate level of data protection. The effect of an adequacy decision is that personal data can be sent from an EEA state to a third country without any further safeguard being necessary.

The UK Government are currently seeking adequacy decisions from the European Commission under both the General Data Protection Regulation and Law Enforcement Directive which, if secured by the end of the transition period, will allow for the free flow of personal data to the UK from the EU to continue uninterrupted. We will update our guidance to reflect the outcome of this. In the meantime, there are steps that you can take to ensure that personal data can continue to flow after the transition period ends. For more information, read our guidance on International Transfers, and our interactive tool on using standard contractual clauses for transfers into the UK.

The UK Government has stated that, at the end of the transition period, transfers of data from the UK to the EEA will be permitted. It says it will keep this under review. The UK Government intends to recognise EU Commission adequacy decisions made before the end of the transition period. This will allow restricted transfers to continue to be made from the UK to most organisations, countries, territories or sectors covered by an EU adequacy decision. You can find more detail in our guidance on international data transfers at the end of the transition period.

We recommend that you regularly check our data protection at the end of the transition period page for updates and new resources.