Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what estimate her Department has made of the number of data flow contractual clauses which will need to be arranged by businesses in the UK with businesses in the EU in the event that the UK leaves the EU (a) with and (b) without a deal.

The Government has now agreed the Withdrawal Agreement with the EU. We believe this is the best outcome for all UK sectors. Businesses will not be required to implement standard contractual clauses to ensure the continued free flow of data from the EU/EEA to the UK.

The implementation period will start on 31 October 2019 and last until 31 December 2020. It is important that businesses continue to comply with their existing data protection obligations during this period. There will be no change in compliance responsibilities for organisations or for individual rights. This is because the UK’s Data Protection Act 2018 remains in place and EU laws including the GDPR and Law Enforcement Directive will continue to apply in the UK. This means that personal data can flow from and to the European Economic Area just as before the UK’s exit.

Looking to the future, both the UK Government and the EU have made clear their intention for the EU to have made adequacy decisions with respect of the UK by the end of the implementation period and for the UK to ensure the comparable facilitation of transfers of personal data to the EU, in the same timeframe, if applicable conditions are met. This would mean that data can flow between the UK and EU without organisations having to put in place other data transfer arrangements.