The EU has an established mechanism to allow the free flow of personal data to countries outside the EU, namely an adequacy decision. The European Commission has stated that if it deems the UK’s level of personal data protection essentially equivalent to that of the EU, it would make an adequacy decision allowing the transfer of personal data to the UK without restrictions. While European Commissison have made it clear EDPB is ready to begin preliminary discussions on an adequacy assessment, the European Commission has not yet indicated a timetable for this and have stated that the decision on adequacy cannot be taken until we are a third country.
If the European Commission does not make an adequacy decision regarding the UK at the point of exit, the entities that want to receive personal data from organisations established in the EU (including data centres) should consider assisting their EU partners in identifying a legal basis for those transfers. For the majority of organisations the most relevant alternative legal basis would be standard contractual clauses. For more information..