• news-banner

    Expert Insights

How does our data protection framework measure up?

DCMS policy paper published to help UK acquire adequacy status from the EC

BACKGROUND

The United Kingdom’s (“UK”) exit from the European Union (“EU”) has raised a number of legal questions, and there has been a lot of discussion and speculation in recent months as to what will happen at the end of the transition period, both in data protection circles and more broadly. One question with wide-ranging practical implications is whether the EU will consider the UK to have an adequate data protection framework and whether it will grant it so-called “adequacy status”.

What is “adequacy status”?

Pursuant to Article 45 of Regulation (EU) 2016/679, General Data Protection Regulation (“GDPR”), the European Commission (“EC”) has the power to determine whether a country outside the EU offers an adequate level of data protection.

Given that the GDPR has been transposed into UK law by the Data Protection Act 2018, one might expect this to be a simple tick-box exercise. However, the process may not be as straightforward. Understandably, the EC’s primary focus is on ensuring that the protections afforded by the GDPR cannot be circumvented when data is transferred outside of the EU. Such action would effectively render their preparation and enforcement of a strict data protection regime redundant. Consequently, the EC will want to consider all aspects of the UK’s data protection framework when taking its decision.

What does it mean to be “adequate”?

Adequacy, from a GDPR perspective, refers to the ability of a country outside the EU to:

  • offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the EU; and
  • ensure that data subjects are provided with effective and enforceable rights and effective administrative and judicial redress.

In its assessment of the adequacy of the data protection framework of a country outside of the EU (a “third country”), the EC will consider a number of factors, including how that third country respects the rule of law, access to justice and the scope of relevant standards and legislation. The EC will also make sure the third country can ensure effective independent data protection supervision and can provide for cooperation mechanisms with other EU data protection authorities¹.

DCMS Policy Paper

The Department for Digital, Culture, Media and Sport (“DCMS”) recently published a policy paper and supporting documents which seek to provide “an overview of the UK’s comprehensive legal framework underpinning high data protection standards”² and which is intended to facilitate adequacy discussions with the EC. The DCMS’ overarching objective is to ensure the UK acquires adequacy status as quickly as possible in order to maintain the continued free flow of personal data between the EU, UK and Gibraltar. The policy paper addresses each of the adequacy criteria described above and seeks to demonstrate not only that the UK currently meets the adequacy status requirements but that it will continue to do so post-Brexit.

PRACTICAL IMPLICATIONS

What does it mean for companies if the UK acquires adequacy status?

Adequacy status would continue to allow the free flow of personal data, which is vital for imports and exports of both goods and services. In practical terms, there is little difference between the current mechanisms for transferring personal data to and from EU countries – as at the date of writing – and the mechanisms required if the UK acquires adequacy status. Other than relatively minor changes to terminology, which may or may not be required, commercial contracts involving the receipt of personal data into the UK from the EU would be largely unaffected.

What happens if the UK does not acquire adequacy status?

Contrastingly, if the UK does not acquire adequacy status, it will be treated by Member States as a third country for the purposes of transfers involving the receipt of personal data into the UK from the EU.
Transfers of personal data intended for processing after transfer to a third country or to an international organisation can only lawfully take place if there is an effective transfer mechanism. A transfer on the basis of an adequacy decision is one lawful transfer mechanism. In the absence of an adequacy decision, options include mechanisms such as:

  • transfers subject to appropriate safeguards, including binding corporate rules or the standard data protection clauses adopted by the Commission, also referred to as the standard contractual clauses; and/or
  • transfers subject to a derogation for a specific situation, including where there is explicit consent of the data subject, important reasons of public interest, or it is necessary in order to protect the vital interests of the data subject or of other persons.

As those of you who have previously dealt with other transfer mechanisms will be aware, binding corporate rules can be cumbersome to put in place and the standard contractual clauses can be awkward to incorporate in what might ordinarily be a streamlined commercial contracting process.

If the UK does not acquire an adequacy decision, Member State organisations would be looking at the above transfer mechanisms to transfer data to UK organisations, making it less straightforward for them to enter into contracts in any data-centric sector.

COMMENTARY

Throughout its policy paper and supporting documents, DCMS demonstrates that “the UK has a wide range of measures that create a digital environment in which citizens can feel safe and secure and have trust in how their data is used”. Whilst we are generally optimistic that a positive decision on our adequacy status should be forthcoming, which would minimise disruption to existing data flows and be one less hurdle for businesses to face, this is an area that should be kept under review. If it becomes apparent that an adequacy decision is not going to be granted as the transition period goes on, businesses will need to put in place an effective transfer mechanism from 2021 onwards.

¹Recital (104), Regulation (EU) 2016/679, General Data Protection Regulation.
²DCMS Explanatory Framework for Adequacy Discussions – Section A: Covering Note

Our thinking

  • IBA Annual Conference 2025

    Simon Ridpath

    Events

  • Alumni Drinks Reception

    Events

  • London International Disputes Week: Trusts hurt: the fraud lawyer, the trust, and the avenues of attack (and defence)

    Tamasin Perkins

    Events

  • London International Disputes Week: Navigating International M&A Disputes: Insights and Strategies for 2025

    Stephen Burns

    Events

  • Government publishes consultation on Regulations about how rent is calculated under the Landlord and Tenant Act 1954 for agreements with Code operators

    Georgina Muskett

    Quick Reads

  • ESG Duties for Directors: Legal Obligations and Risks Under English Company Law

    Katie Bewick

    Insights

  • Unlocking Opportunities: Introduction of the Re-domiciliation Regime in Hong Kong

    Shirley Fu

    Insights

  • Conclusive truth or abusive sleuth - can covert recordings be used in family law proceedings?

    Charlotte Posnansky

    Insights

  • Successors in title bound by predecessors’ boundary demarcation agreement, notwithstanding lack of knowledge

    Emma Preece

    Quick Reads

  • Law Commission publish their recommendations for reform on Wills

    Charis Thornton

    Quick Reads

  • What does the UK Immigration White Paper mean for businesses, families and entrepreneurs?

    Paul McCarthy

    Insights

  • BBC News quotes Emma Preece on a Supreme Court decision around whether people can camp in certain areas of Dartmoor without permission from landowners

    Emma Preece

    In the Press

  • From Tradition to Transaction - The Rise of Private Equity in Family Businesses in the Middle East

    Ahmad Anani

    Insights

  • The UK’s immigration white paper – what does it mean for British Nationals (Overseas)?

    Owen Chan

    Quick Reads

  • Directors’ Disqualification Under the Company Directors Disqualification Act 1986: What UK Directors Need to Know

    Claudine Morgan

    Insights

  • The Financial Times quotes Catrin Harrison on IHT Budget changes and the impact on wealthy UK expats

    Catrin Harrison

    In the Press

  • Property Patter: Applications to discharge or modify restrictions

    Emma Humphreys

    Podcasts

  • Should access be given between exchange and completion?

    Twiggy Ho

    Insights

  • What next for the hydrogen sector?

    Rachael Davidson

    Quick Reads

  • UK Cybersecurity and Resilience Policy Statement April 2025 - Impacts for Managed Services Providers and Data Centres

    Mark Bailey

    Insights

Back to top