Can you transfer personal data to the UK after Brexit?
The United Kingdom is no longer a member of the EU from 1 February 2020. For a transitional period until 2020, the United Kingdom was treated as an EU country. Regarding privacy law, this meant that the EU Privacy Regulation (GDPR) applied to the United Kingdom until the end of 2020.
Also read: Brexit National Insurance
On January 1st, Norway passed a temporary regulation stating that transfer of personal data to the United Kingdom shall not be treated as transfer to a third country in accordance with GDPR. It is not determined when the regulation will expire, but at the latest it will expire six months after the UK-EU Trade and Cooperation Agreement is accepted in both EU and the United Kingdom.
Also read: Brexit's impact on Norwegian corporations with UK management
The European Commission is now investigating whether the United Kingdom ensures an adequate level of protection for the processing of personal data. If the EU Commission answers "yes" to this question, personal data can be transferred to the UK without a special transfer basis even after the temporary regulation has expired.
It is still uncertain what will happen after the expiration of the temporary regulation, and we advise all companies to follow the process closely. It might be that the transfer of personal data to the United Kingdom will require a special transfer basis in the future.
Also read: Brexit and British citizen’s in Norway
Also see: Brexit overview
First published November 2020, updated May 2021.