UK data protection, GDPR, DPIAs, international transfers, data protection for AI-enabled products
Quick answer. In June 2022 the UK government set out proposals to reform UK data protection law across five areas: reducing barriers to responsible innovation, reducing burdens on business, boosting international data flows, delivering better public services, and reforming the ICO. These proposals became the Data Protection and Digital Information Bill, which was later reworked…
This article was published in March 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. In February 2022 the UK published two alternative sets of contracts for exporting personal data from the UK to non-adequate countries: the International Data…
This article was published in September 2021 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The UK government published proposals on 10 September 2021 to reform UK data protection law, using post‑Brexit freedom to set separate UK rules. The…
On 28 June 2021, the EU Commission found that the UK provides adequate protection for personal data, enabling personal to freely flow from the EU (and EEA) to the UK. Editorial note (April 2026): The EU adequacy decision for the UK was adopted on 28 June 2021 for a period of four years, expiring on…
Quick answer. From 27 June 2021 exporters of personal data from the EU to third countries could adopt the new EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914. Existing contracts using the pre‑2021 SCCs had to transition to the new clauses by 27 December 2022. From 27 June 2021, organisations will be able…
EU progresses revised ePrivacy Regulation
Quick answer. The European Data Protection Board’s recommendations of 10 November 2020 set out a six‑step method for assessing whether personal data can be transferred outside the EU after Schrems II, together with examples of supplemental technical, contractual and organisational measures. In documents published last week, the EU provided some welcome clarity on how organisations…
This article was published in November 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. On 10 November, the European Data Protection Board adopted a recommendation on supplemental measures which might be used to ensure compliance with the EU level of…
This article was published in September 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. The European Data Protection Board’s updated guidance of 7 September 2020 refined the tests for distinguishing controllers from processors under GDPR Articles 4, 24,…
Quick answer. The EU Commission and US Department of Commerce announced on 10 August 2020 that they had started talks on a successor to the invalidated Privacy Shield. Agreement was eventually reached in July 2023 as the EU–US Data Privacy Framework. On 10 August 2020, Following the European Court’s Schrems II judgment invalidating the US…
This article was published in July 2020 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights. Quick answer. After Schrems II, exporters of personal data from the EU to the US and other third countries must rely on an alternative Article 46…
Schrems II disrupts data export from EU: on 16 July 2020, the European Court of Justice decided, overturning the 2016 Privacy Shield Decision of the European Commission, that the US Privacy Shield did not, and does not, provide an adequate level of protection for the transfer of personal data from the EU to the US.