On June 28, 2021, the European Commission adopted an adequacy decision for the UK<\/a>, ensuring the continued free flow of personal data between the two blocs for the next four years.<\/p>\n\n\n\n Under the EU\u2019s GDPR, adequacy decisions can be adopted by the EU if it deems that a third country (i.e. a country outside of the European Union) has an equivalent level of data protection. If so, personal data from EU residents can be transferred to the country freely (still requiring end-user consent, as always of course).<\/p>\n\n\n\n Since the UK left the EU under Brexit, the UK is not covered by the GDPR anymore, and adequacy talks have been a point of importance to ensure continued flow for websites, companies, and organizations in both blocs.<\/p>\n\n\n\n Particular to the UK adequacy decision from June 2021<\/a> is a so-called \u201csunset clause\u201d that strictly limits the free flow of data to a 4-year period from the effective date, after which the adequacy status of UK will not automatically be renewed. If the EU chooses to renew the agreements, a new adoption process will start.<\/p>\n\n\n\n The UK already has in place a new domestic data privacy law called UK-GDPR that is exactly the same as the EU version and is supported by the UK\u2019s Data Protection Act of 2018.<\/p>\n\n\n\n Compliance with the UK-GDPR and EU\u2019s GDPR remains an obligation for any website, company or organization who process personal data form either inside the UK or EU: the explicit consent of users must be obtained<\/strong> before any processing or transfer is allowed to take place.<\/p>\n\n\n\n See the UK adequacy decision from June 2021<\/a><\/p>\n\n\n\n See the ICO\u2019s consultation on data transfers to and from the U.K. from August 2021<\/a><\/p>\n\n\n\n Learn more about GDPR and end-user consent<\/a><\/p>\n\n\n\n Being compliant with the EU GDPR, the new UK-GDPR and the supporting data protection legislations such as the Data Protection Act 2018 might seem a tad confusing, what with all the other messy stuff that comes with Brexit.<\/p>\n\n\n\n Cookiebot CMP<\/a> by Usercentrics<\/a> is the world-leading GDPR compliance solution for websites of all shapes and sizes.<\/p>\n\n\n\n Built around a powerful scanner that detects all cookies, trackers and trojan horses, our solution gives your users automatic control of their personal data, in full compliance with the requirements of both the EU and UK data privacy regime.<\/p>\n\n\n\n Cookies are one of the most common ways<\/a> that websites process personal data, so it\u2019s super important in terms of data law compliance to both know what cookies are active on your website and to enable your end-users with a choice of prior consent as to which cookies they want active, when visiting your domain.<\/p>\n\n\n\n By simulating visitors on your website \u2013 scrolling, clicking, exhausting all possible uses of your domain \u2013 our solution detects trackers present, both first party (your own website\u2019s) and third party (usually marketing cookies from ad tech companies that are privacy invasive).<\/p>\n\n\n\n With highly customizable consent banner and automated geo-targeting, we take the hard part out of being compliant with the world\u2019s major data privacy laws.<\/p>\n\n\n\n Cookiebot CMP <\/a>offers plug-and-play compliance with the EU\u2019s GDPR<\/a>, UK\u2019s GDPR<\/a>, California\u2019s CCPA\/CPRA<\/a>, Brazil\u2019s LGPD<\/a>, South Africa\u2019s POPIA<\/a>, Singapore\u2019s PDPA <\/a>and more.<\/p>\n\n\n\n Learn more about the GDPR and consent<\/a><\/p>\n\n\n\n The General Data Protection Regulation (GDPR) <\/a>is an EU law that took effect in May 2018 and is uniformly binding in all 27 EU nations. It controls how companies and organizations are allowed to handle personal data<\/strong>.<\/p>\n\n\n\n Personal data<\/strong> is defined in the GDPR as anything that can be directly or indirectly identified to a natural person, such as names, physical addresses, IP addresses, location data, and information about physical, mental, economic, cultural or social facts.<\/p>\n\n\n\n Sensitive personal data<\/strong>, however, is defined by the GDPR as data about religious convictions, political opinions and\/or sexual orientation.<\/p>\n\n\n\n The GDPR clarifies in total eight rights<\/strong> for individuals, including the right to request access to one\u2019s data (a so-called Subject Access Request or SAR), as well as to request their personal data deleted.<\/p>\n\n\n\n However, the most important right that the GDPR empowers EU citizens with is the right to not have their data (personal or sensitive) collected and processed without prior consent<\/strong>.<\/p>\n\n\n\n Here, the GDPR requires websites to -<\/p>\n\n\n\n This is the backbone of GDPR compliance.<\/p>\n\n\n\n In doubt whether your website is GDPR compliant? Test with Cookiebot's free compliance test<\/a>.<\/p>\n\n\n\n The United Kingdom has been regulated by the European GDPR since it took effect in May 2018.<\/p>\n\n\n\n Upon leaving the EU on January 1, 2021, the UK is officially not a part of the EU\u2019s GDPR any longer, i.e. the EU\u2019s GDPR does not have any domestic jurisdiction in the UK as it had from May 2018.<\/p>\n\n\n\n The UK has passed its own version called the UK-GDPR, which alongside the Data Protection Act of 2018, is in effect now.<\/p>\n\n\n\n The new UK-GDPR is essentially the same as its European predecessor, only revised so as to cover areas of the domestic law that are not touched upon by the EU regulation. These include among others national security, the intelligence services and immigration.<\/p>\n\n\n\n Learn more about the UK-GDPR<\/a><\/p>\n\n\n\n Learn more about the Data Protection Act 2018<\/a><\/p>\n\n\n\n See IAPP's comprehensive Brexit privacy checklist<\/a><\/p>\n\n\n\n The Information Commissioners\u2019 Office<\/a> has several data laws to enforce in the UK.<\/p>\n\n\n\n After Brexit on January 1, 2021<\/strong>, the following data laws has taken effect in the UK:<\/p>\n\n\n\n PECR is the UK\u2019s national implementation of the European ePrivacy Directive. It deals with the protection of personal data in relation to electronic communications, specifically cookies and online marketing communications.<\/p>\n\n\n\n Visit the ICO to read more about the PECR.<\/a><\/p>\n\n\n\n Since it\u2019s a national implementation, i.e. a domestic UK law, the PECR will still apply after Brexit<\/strong>.<\/p>\n\n\n\n ICO updated its guidelines regarding the use of cookies, and hence processing of user data, according to the PECR. It has done so in order to align it with the consent standards of the GDPR.<\/p>\n\n\n\n ICO has ruled that the only form of valid consent on websites are consents given prior to the initial tracking, obtained through cookie banners without any pre-ticked checkboxes<\/strong>.<\/p>\n\n\n\n Read more about the updated guidelines on ICO\u2019s own website.<\/a><\/p>\n\n\n\n Website owners and operators are no longer allowed to collect or process personal information if users simply close a cookie banner or choose to keep browsing on a site after the popping up of a cookie banner.<\/p>\n\n\n\n Instead, users must affirmatively consent by clicking and ticking the boxes of all categories of cookies apart from the strictly necessary ones on which a website functions.<\/p>\n\n\n\n While the UK was still a part of the European Union, it was the responsibility of the Information Commissioner\u2019s Office (ICO)<\/a> to enforce the EU's GDPR on UK soil.<\/p>\n\n\n\n However, since the UK is no longer an EU member state, the main responsibilities of the ICO will now be to enforce its own domestic version, the UK-GDPR<\/a>, and the supporting Data Protection Act of 2018<\/a>.<\/p>\n\n\n\n The EU's GDPR is enforced by the national data protection authorities (so-called DPAs) in each EU nation, although special responsibility and power falls to the Irish DPA for being the lead regulator of the GDPR in EU.<\/p>\n\n\n\n This is because a provision in the GDPR specifies that the law\u2019s lead regulator must be the DPA of the country that houses a tech company\u2019s data controller, which is the case for Ireland when it comes to both Facebook and Google.<\/p>\n\n\n\n ICO is the enforcer of the GDPR in the UK with the power to conduct criminal investigations and issue fines, as was witnessed last year when it raided the offices of Cambridge Analytica<\/a>, the disgraced data firm that abused the personal information of 87 million people, obtained through Facebook, to influence both British and US elections.<\/p>\n\n\n\n After Brexit, the ICO<\/a> will become the enforcer, supervisor and regulator of the domestic UK-GDPR<\/a>.<\/p>\n\n\n\n According to the GDPR, UK websites and companies who fail to comply with its requirements can be fined up to \u20ac20 million<\/strong> or four percent<\/strong> of a company\u2019s annual global turnover, whichever is greater.<\/p>\n\n\n\n So far the GDPR fines in UK vary a lot in form and strength.<\/p>\n\n\n\n ICO<\/a> has enforced the GDPR in the UK on numerous occasions already.<\/p>\n\n\n\n A lot of the monetary penalties issued by ICO<\/a> a year after the date of effect of the GDPR in the UK center around unsolicited direct marketing, which is unlawful according the to GDPR. Prior consent from its customers or users is required before a company or website can undertake direct marketing.<\/p>\n\n\n\n ICO<\/a> has stated that it prefers to work with organizations to improve their practices, rather than seeking maximum fines.<\/p>\n\n\n\n Its GDPR enforcement has so far taken shape as monetary penalties, but also guidance to companies and organizations in order to improve their practices and sometimes \u201ca stern letter can be enough\u201d, ICO stated<\/a>.<\/p>\n\n\n\n If you process personal data of individuals in the UK, you must comply with the GDPR, the Data Protection Act 2018 and the PECR.<\/p>\n\n\n\n After Brexit, you must comply with the new UK-GDPR, the Data Protection Act 2018 and the PECR.<\/p>\n\n\n\n The UK has an adequacy agreement with the EU<\/a>, ensuring the free flow of personal data between the two bloc for a four-year period (until June 2025).<\/p>\n\n\n\n Cookiebot CMP<\/a> enables full compliance all domestic UK data privacy laws and the EU's GDPR.<\/p>\n\n\n\n So, to sum up -<\/p>\n\n\n\nGDPR compliance after Brexit in 2021<\/h2>\n\n\n\n
Cookiebot CMP for UK compliance<\/h3>\n\n\n\n
What is GDPR?<\/h2>\n\n\n\n
![\"Flag](\"\/media\/3624\/europe-3220208.jpg?width=411&\")
\n
GDPR in the UK after Brexit 2021<\/h3>\n\n\n\n
GDPR and the UK's other data laws<\/h2>\n\n\n\n
\n
![\"Westminster](\"\/media\/3630\/london-530055.jpg?width=397&\")
ICO and cookies - updated guidelines to the PECR<\/h3>\n\n\n\n
![\"Cookieboot](\"\/media\/4333\/consent_en.png?width=500&\")
Who enforces GDPR in the UK?<\/h2>\n\n\n\n
![\"ICO](\"\/media\/3629\/ico.png?width=408&\")
ICO and GDPR<\/h3>\n\n\n\n
GDPR fines UK<\/h3>\n\n\n\n
How to comply with the GDPR in the UK<\/h2>\n\n\n\n
Summary<\/h2>\n\n\n\n
GDPR and the UK<\/h3>\n\n\n\n