News that the UK and EU have reached an agreement (in principle, as it still needs to be ratified by both sides) on trade following expiry of the Brexit transition period came as an early Christmas present to many, including the data protection practitioners amongst us (sort of).

The EU has not granted the UK adequacy status (yet), but the trade agreement will, in effect, extend the existing transitional arrangements for four months (which can be extended by a further two months), provided the UK's data protection legislation doesn't diverge in the meantime (Article FINPROV.10A). So, for now, we have some breathing space; there's no need to put in place safeguards (e.g. Standard Contractual Clauses) to legitimise the transfer of personal data from the EU to the UK (transfers the other way are unlikely to be restricted, unless the UK changes its stance on this).

Will an adequacy decision for the UK follow in 2021? Hopefully, but there are no guarantees, so organisations should continue to prepare for the possibility that the UK will be treated as a non-adequate 'third country' in Q3 2021.