#privacy: ICO urges businesses to “prepare for all scenarios”

Businesses have been urged to “prepare for all scenarios” as the ICO publishes dedicated guidelines to maintain data flows when the UK leaves the EU. 

The guidelines are to help small and medium sized organisations prepare for the possibility that the UK leaves the European Union with no deal. It provides the same advice that was previously published on how to maintain data flows, but tailored to be more relevant and accessible to smaller organisations.

The sharing of customers’, citizens’ and employees’ personal data between EU member states and the UK is vital for business supply chains to function and public authorities to deliver effective public services. 

At the moment the UK is an EU member state, therefore personal data flow is unrestricted. In the event of a “no deal” Brexit, EU law will require additional measures to be put in place where personal data is transferred from the European Economic Area (EEA) to the UK, in order to make them lawful. 

The guidelines sets out steps to take to keep the information flowing such as using pre-approved contract terms. 

Information Commissioner Elizabeth Denham said:

“It’s crucial that organisations make sure they properly prepare for all scenarios. If your organisation sends or receives personal information to countries in the EU, this guidance will help you work out whether you need to take steps now, what you need to do to prepare, and then let you get back to running your business.

“Even if you think your organisation doesn’t transfer data internationally, I’d urge you to read what we’ve produced, and assess whether you need to act.”


PrivSec Conferences will bring together leading speakers and experts from privacy and security to deliver compelling content via solo presentations, panel discussions, debates, roundtables and workshops.

For more information on upcoming events, visit the website.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.