Insights
Training
On-demand
INSIGHTS
All Topics
What does Brexit mean for GDPR?
01 Feb 2021by Joe Lepper
Data protection is a priority for all charities, but how does the UK’s departure from the EU effect legislation in this area?
Charities use of data and how they store information changed dramatically in 2018 when the EU’s General Data Protection Regulation (GDPR) came into force.
This tightened up legislation across Europe around the transfer of personal data across borders and gave individuals greater control over their data.
For charities, the change meant ensuring people have a clear choice about the information that is held about them and how it is used. Procedures had to be altered to give users more of a say, and customer relationship management systems had to be reviewed to ensure data was handled securely.
But with the UK leaving the EU and hammering out the first stages of its trading relationship post-Brexit, where does that leave this crucial piece of data protection law?
GDPR still applies to UK charities
In practice there is little change to the key principles to protect data and the rights of individuals around information stored on them.
Despite the EU’s GDPR no longer applying to the UK, it has been incorporated into UK data protection law so the UK’s GDPR still applies. This sits alongside the UK’s Data Protection Act of 2018.
The UK does have the power to change and develop its data protection legislation. There are no plans in place to do so, but under the terms of the UK’s departure from the EU it is required “as far as is reasonably possible” to notify the EU if the UK plans to do this.
Follow-up questions for CAI
How does UK GDPR maintain data protection standards post-Brexit?What are the recommended safeguards for transferring EU data to the UK?How should charities manage data collected before and after Brexit?What role does the ICO play in monitoring UK-EU data flows?How can software tools assist charities in GDPR compliance after Brexit?Transferring data across Europe
The trade agreement, brokered at the end of 2020, outlines that transfer restrictions are delayed for at least another four months and can possibly be extended to six months.
That means personal data can still flow freely across Europe to the UK for the time being and, unless one side objects, the EU will not be treated as a ‘third country’ – a non-EU or non-European Economic Area country – in terms of the management of data across international borders, providing no changes are made to existing data protection legislation.
However, after April 2021, the Information Commissioner’s Office (ICO) recommends that, if a charity or other organisation receives personal data from within Europe, they put in place alternative data safeguards in place, if they haven’t done so already.
To help, the ICO has developed a useful interactive tool to use on contractual clauses for transfers into the UK. This includes across the border between EU member state Ireland and Northern Ireland. The ICO says it will continue to monitor the flow of data across this border “and provide any necessary updates as soon as possible”.
Charities are also advised to check whether or not they are storing data in the EU via cloud or local server for back up.
Data collected before the UK left the EU
The signing of the UK-EU Trade Agreement on 31 December 2020 is a key date. Data collected before this date needs to comply with EU data protection law. Data collected after this date needs to comply with UK data protection law.
This means that organisations are advised to ensure they know which legislation applies to which data, based on when it was collected.
Further information
The ICO wants to ensure data continues to flow securely to and from the UK and has produced a useful webinar on data protection and the end of the UK’s transition out of the EU.
The National Council for Voluntary Organisations (NCVO) is another organisation that can offer up-to-date information on the changing landscape for data protection in the UK post-Brexit.
To support its work in this area it has for the last three years used data protection consultancy Hope and May. Support includes information from Hope and May on what small- and medium-sized organisations need to consider around GDPR and Brexit.
The NCVO also emphasises the importance for charities of having clear policy in place for data protection. It says: “Every organisation should have a written policy and procedure that is specific to their context about how they handle personal data and enact privacy principles.”
Another source of information is the Directory of Social Change, which offers advice from data protection expert Paul Ticher on the implications of Brexit on GDPR specifically for charities.
Software suppliers to charities should also be able to help ensure data is collected securely and adheres to the relevant UK or EU law. For example, Microsoft 365 offers advice on how charities can simplify GDPR compliance.
This includes advice on how to discover and explore data, control where it is stored and migrating data to the cloud.
Joe Lepper
Joe Lepper
More on this topic
Recommended Products
16 Jan 2026by Ioan Marc Jones
A complete guide to volunteer management
15 Jan 2026by kirsty marrins
AI and the future of service delivery
14 Jan 2026by Claire Tavernier
The “digital trustee” era is over
Our Events
11 Feb 2026Online
Masterclass: Working smarter with AI: A practical introduction
Charity Digital Academy
Our courses aim, in just three hours, to enhance soft skills and hard skills, boost your knowledge of finance and artificial intelligence, and supercharge your digital capabilities. Check out some of the incredible options by clicking here.
© 2022 Charity Digital Trust. All rights reserved
