The Information Commissioner’s Office (ICO) has published dedicated guidance to assist small and medium-sized businesses in their preparations for a no-deal Brexit and has urged them to “prepare for all scenarios” to maintain data flows when the UK leaves the EU. The guidance for small and medium-sized businesses is not entirely new as the ICO has, in fact, tailored its previously published no-deal Brexit guidance to be more relevant and accessible to smaller businesses.
At the moment, personal data flow is unrestricted because the UK is a member of the EU. In the event of no deal, EU law will require additional measures to be put in place when personal data is transferred from the EEA to the UK in order to make such data transfers lawful. The ICO’s guidance sets out steps to take to keep personal data flowing, such as using pre-approved contract terms. It says that: