On the 1st January 2021, the United Kingdom (UK) finally left the European Union (EU), following the end of the transition period. On the 30th December 2020, the UK and EU signed a Trade and Cooperation Agreement (TCA). The TCA covers several areas, including free trade in goods and limited mutual market access in services. But what is the position in relation to data transfers between the EU and the UK?
It is well known that the EU takes data protection very seriously. The EU Charter of Fundamental Rights  stipulates that EU citizens have the right to protection of their personal data. In 2016, the EU adopted the General Data Protection Regulation (GDPR). The GDPR addresses – among other things - the transfer of personal data both within and outside the EU area.
The GDPR is an EU regulation. This means that it became law in all EU member states without the need for an Act of Parliament. However, in 2018 the UK did pass an Act of Parliament which both updated data protection laws in the UK and which complemented the GDPR.
Following ‘Brexit’ , the position will not immediately change. The UK and the EU have agreed that, for six months, data can flow on an unrestricted basis, as was the position when the UK was a member state of the EU. However, the UK must now make an application for an ‘adequacy decision’. According to the Institute for Government:
‘Data adequacy is a status granted by the European Commission to countries outside the European Economic Area who provide a level of personal data protection comparable to that provided in European law.’ 
If the application for an adequacy decision is approved, the free flow of personal data between the EU and the UK will probably continue as it is. If the application is rejected, however, there would then be a restriction on the flow of data from the EU to the UK. At that point, the execution of Standard Contractual Clauses (SCC) will probably be required.
SCCs are a mechanism for transferring personal data from the EU/European Economic Area. In November 2020, the European Commission published its proposals for a new set of SCCs. The purposes of the updated SCCs include to:
· Implement the recent landmark decision of the Court of Justice of the European Union in ‘Schrems II’ 
· Increase the ability of ‘data exporters’ to rely on SCCs without the need for more safeguards
· improve the strength of the SCCs and address problems and gaps in the existing ones.
As usual, however, it is a good idea for any organisation in the UK which has data flows with organisations in the EU to think carefully about the possibilities and practical legal effects – including the operation of SCCs – if the UK’s application for an adequacy decision is rejected.
 ‘Brexit’ is a portmanteau word (a word made up from two different words). Here, the combination of words is ‘British’ and ‘exit’, combined to make ‘Brexit’.
 Data Protection Commissioner v Facebook Ireland Ltd, Maximillian Schrems and Intervening Parties http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=9745404
Find a word or phrase in the text which means:
1. Time when something is changing from one thing to another.
2. A feeling or action which is shared by two or more people or groups
3. To say clearly how something must be done
4. To modernise something or make it more suitable
5. Added new or different things to make it more complete or suitable
6. To have a special importance or position
7. Formally accepted or agreed as satisfactory
8. Not accepted or approved
9. An event which is very important, particularly if it changes something in an important or significant way.
10. To think about and begin to deal with something
1. transition period
[Note: The material in this article is for educational and study purposes only. It should not be used for, or as the basis of, legal advice. If you need legal advice on any issue, you should always use the services of an appropriate legal advisor.]
© Cambridge Legal English Academy 2021