On 28 June 2021, the European Commission (the “EC”) adopted two adequacy decisions under the General Data Protection Regulation (“GDPR”) and the Law Enforcement Directive (“LED”), respectively, that ensure the continued free flow of personal data from the European Economic Area (“EEA”) to the UK without restrictions.
Restrictions on transfers from the EU/EEA to third countries
Under the GDPR and the LED, organisations are restricted from transferring personal data to a ‘third country’, unless: (i) that country has an adequacy decision from the EC; (ii) a derogation for occasional and non-repetitive transfers applies (e.g. consent); or (iii) additional safeguards are put in place (e.g. the EU standard contractual clauses (“SCCs”) or binding corporate rules (“BCRs”)).
Please see full Publication below for more information.