Scenario #1 – The UK leaves the EU but remains within the European Single Market

In terms of your GDPR compliance requirements, not much should change. You would still require a DPO under the GDPR (rather than an Article 27 EU Representative), which could be based in the UK or any of the member states. In this case, however, companies may wish to appoint multiple DPOs (one in the UK and one in an EU member state) to protect themselves from future regulatory divergence and uncertainty.

Scenario #2 – The UK leaves the European Single Market with an Adequacy Decision

In this case, the free flow of data between the UK and the EU would be able to continue, though the compliance obligations would likely change from that of an EU-based DPO under Articles 37-39 to an EU Representative under Article 27.

Scenario #3 – The UK leaves the Single Market without an Adequacy Decision

While we would consider this the least likely scenario, we would envision two different ways
that this could unfold:

How can I best be prepared for post-BREXIT GDPR compliance?

The best way to be prepared and to further mitigate your compliance risk is to plan ahead for the different possible scenarios while the situation continues to unfold. In this, Adaptant can provide you with support for a hassle-free (as far as the GDPR is concerned) transition and minimal disruption to your customers. It’s as easy as 1, 2, 3!

1. Pre-BREXIT: Let us be your DPO in the UK through our newly-established UK Services entity;
2. If the UK leaves the Single Market, we can swap you seamlessly to our EU Representative service (our main office is based in Germany);
3. If the UK is classed as a third country or must negotiate an adequacy framework with the EU post-BREXIT, we can, in addition to acting as your EU Representative, help you draft BCRs, Privacy Policies, and Data Processing Agreements, etc. We can get you back on the path to compliance with minimal fuss and disruption to your EU-based customers across a range of data transfer mechanisms.