Data processing locations post-Brexit

Question

I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.

I have several UK-based clients, all using the Amazon Ireland datacentre for storing and processing data. Some of these clients have customers exclusively within the UK, others have a customers world-wide. All are deemed to currently operate within the GDPR.

In the event of a no-deal departure on Oct 31st, what would be the effect on:

a) the clients with UK-only customers. Would they be able to continue storing their data in Ireland? From the latest guidance at https://www.gov.uk/guidance/using-personal-data-after-brexit:

UK businesses and organisations will continue to be able to legally send personal data from the UK to the EEA and 13 countries deemed adequate by the EU.

I believe this is the case.

b) the clients with EU customers. While the guidance at the above link states clients must:

include Standard Contractual Clauses (SCC) or other Alternative Transfer Mechanisms (ATM) to ensure that you can continue to legally receive personal data from the EU/EEA

this doesn't mention any implications on where this data is processed. From the EU perspective I can't imagine that it matters where the processing happens (since ultimately the data is being held by a UK-based company), so again are these clients able to keep using in the Ireland datacentre provided they comply with the above?

Answer 1

In the GDPR, international data transfers occur when the target/recipient of the transfer is or is in:

• a third country, i.e. not an EU member state; or
• an international organization, i.e. not subject to the laws of any country.

Transfers into an EU member state are not international transfers in this sense.

Therefore, a post-Brexit UK data controller needs to considers international transfers

• when they receive personal data, as the UK will be a third country; or
• when they send personal data to non-EU recipients, possibly including transfers to a different establishment of the same controller.

From the GDPR perspective, it is no problem at all when a post-Brexit UK data controller does processing in the EU. Additionally, note that whether the GDPR applies does not depend on the location of the processing but only on the location of the data controller and the data subject.

For data controllers that do not transfer data internationally or only transfer personal data out of the UK, nothing will change substantially. But post-Brexit DPA/GDPR compliance will be a headache for anyone transferring personal data into the UK.