2

Can you please tell me, whether we can store PII data belong to UK in EU region? I know the other way round is illegal. But I could not find a place where this problem address properly. Can you please help me with this?

1
  • It Depends... Get a lawyer. – Trish Feb 15 at 16:45
5

When personal data is transferred between the EU and UK, this is an “international transfer” (also called “restricted transfer” in ICO guidance).

Transfers of personal data from the UK to the EU/EEA are easy since the UK has granted an adequacy decision to the EU (see Art 45 GDPR). Nevertheless, this must be disclosed to data subjects per Art 13(1)(f) GDPR.

Transfers of personal data from the EU to the UK are different. An adequacy decision is still under negotiation, but is not guaranteed. As an interim measure, the Brexit trade deal says that transfers of personal data into the UK are temporarily not considered international transfers, so that no legal basis such as an adequacy decision is needed. This interim measure will expire after April, but will likely be extended to expire after June. If this temporary measures expires before an adequacy decision is in place, alternative transfer mechanisms such as standard contractual clauses (SCCs) have to be used. In a way, the temporary measure allows an extended transition period for putting SCCs into place.

9
  • Thank you for your explanation. but can you please elaborate little on how can we store data? – yello_flash Feb 15 at 17:09
  • 1
    @yello_flash What particular concern do you have about storage? If you want to store data in some country, you must transfer it there first. – amon Feb 15 at 18:05
  • thanks for your explanation. initially, I actually did not consider the fact you mentioned above. When I refer to the data transfer, I meant access to the UK data after storing data in the EU region data center. Let's say you have a PHP application coupled with MySQL database which contains UK PII data, I want to know whether this database can be stored in EU region data center? what is the legal aspect of it? – yello_flash Feb 17 at 6:06
  • 1
    @yello_flash I'm having a bit of trouble following what exactly you're saying. Some of your processing activities may fall under the UK GDPR, such as any processing of personal data relating to the offering of goods and services to people in the UK. Processing activities can include transfers to and from the EU. But since the UK has granted an adequacy decision to the EU, transfers from the UK to the EU are generally fine. Subsequent transfers out of the EU might be a bit more tricky, but are by no means impossible. – amon Feb 17 at 10:06
  • 1
    @yello_flash The EU has created a draft adequacy decision, and will likely pass it in time. Then, no SCCs will be required. If you want to set up SCCs in case the adequacy procedure fails, you will have to use the terms that have been pre-approved. For EU → UK transfers between controllers, I think you'll have to adapt the terms approved for the Data Protection Directive that preceded the GDPR (see: ec.europa.eu/info/law/law-topic/data-protection/…) – amon Mar 17 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.