I'm trying to understand (as much as is possible given the uncertainty) the implications of Brexit on data processing / GDPR and how it pertains to my clients.
I have several UK-based clients, all using the Amazon Ireland datacentre for storing and processing data. Some of these clients have customers exclusively within the UK, others have a customers world-wide. All are deemed to currently operate within the GDPR.
In the event of a no-deal departure on Oct 31st, what would be the effect on:
a) the clients with UK-only customers. Would they be able to continue storing their data in Ireland? From the latest guidance at https://www.gov.uk/guidance/using-personal-data-after-brexit:
UK businesses and organisations will continue to be able to legally send personal data from the UK to the EEA and 13 countries deemed adequate by the EU.
I believe this is the case.
b) the clients with EU customers. While the guidance at the above link states clients must:
include Standard Contractual Clauses (SCC) or other Alternative Transfer Mechanisms (ATM) to ensure that you can continue to legally receive personal data from the EU/EEA
this doesn't mention any implications on where this data is processed. From the EU perspective I can't imagine that it matters where the processing happens (since ultimately the data is being held by a UK-based company), so again are these clients able to keep using in the Ireland datacentre provided they comply with the above?