Data protection and no-deal Brexit for small businesses and organisations


This guidance is designed to help small to medium-sized UK businesses and organisations keep personal data flowing with Europe (the EEA) after Brexit. (The EEA is the EU plus Iceland, Norway and Liechtenstein.)

If we leave the EU without a deal, most of the data protection rules affecting small to medium-sized businesses and organisations will stay the same.

The UK is committed to maintaining the high standards of the GDPR (General Data Protection Regulation) and the government plans to incorporate it into UK law after Brexit.

If you are a UK business or organisation that already complies with the GDPR and has no contacts or customers in the EEA, you do not need to do much more to prepare for data protection compliance after Brexit.

If you are a UK business or organisation that receives personal data from contacts in the EEA, you need to take extra steps to ensure that the data can continue to flow after Brexit.

If you are a UK business or organisation with an office, branch or other established presence in the EEA, or if you have customers in the EEA, you will need to comply with both UK and EU data protection regulations after Brexit. You may need to designate a representative in the EEA.

Use this guidance document to understand whether you will be affected and to find out how you need to prepare. It also links to additional guidance about how to improve your data protection knowledge and compliance.

A note from ICO

We now have a short animation ‘No Deal No Data?’ which we would like you to share with your members. The animation outlines how organisations can use toolkits and checklists on the ICO website to maintain the flow of personal data in the event of no-deal.

We are aware that many organisations have Brexit information hubs on their websites or might be planning Brexit-related newsletters or social media campaigns. We’d like to get as many people as possible to see this and would appreciate any help you can give us to get the message out to your stakeholders.

The link to the video is here: