Northern Ireland and personal data flows from the EU after 1 January 2021 - key actions

Guide

Last updated 4 January 2021

The EU-UK Trade and Cooperation Agreement contains a 'bridging mechanism' that allows the continued free flow of personal data from the EU/EEA to the UK after the transition period until adequacy decisions come into effect.

The bridging mechanism will last for up to six months after 1 January 2021. Whilst the bridging mechanism is in force, personal data can continue to flow from the EU/EEA into the UK without additional requirements. 

Actions to take now

As a precaution, before and during the bridging period, you should work with the EU/EEA organisations who transfer personal data to you to put in place alternative transfer mechanisms to safeguard against any interruption to the free flow of EU to UK personal data - for example, if an adequacy decision is not reached.

There are six actions you can take to prepare for a no data adequacy decision from the EU:

  1. Understand whether your business has personal data flowing from the EEA, including the Republic of Ireland
  2. Understand who is transferring the data
  3. Discuss with the EEA business counterpart the best alternative transfer mechanism to adopt in order to maintain this data flow, for example, standard contractual clauses
  4. Ensure alternative transfer mechanisms are agreed with your EU counterparts and are put in place before the bridging mechanism comes to an end. For further information, see ICO's guidance on data protection after 1 January 2021.
  5. Sign up for the ICO newsletter for up-to-date information
  6. Read more about using personal data in your business or other organisation from 1 January 2021

For international data transfers from the UK to other jurisdictions, see ICO's guidance on international data transfers.


First published 17 December 2020