Concerned and confused by backup and Brexit? You’re not alone

24/10/19

One way or another, we may finally be in the Brexit endgame. However, there is still a great deal of uncertainty ahead. For instance, while we may be reaching towards a withdrawal agreement, there is still the risk of no deal either on October 31st or at the end of a long transition period. This in turn means there is still no cast-iron guarantee that the free flow of personal data between the EU and UK will be allowed. If the worst does happen, we could face months or even years before the country regains its data adequacy status. In the meantime, enterprises may have to make significant changes to their legal arrangements, systems and processes to ensure they aren’t in danger of falling foul of regulations.

To gauge whether enterprises are aware of this risk, whether it concerns them, and how prepared they are, we at 4sl commissioned a survey of IT decision makers at 200 large enterprises across the UK in October. We found that, if you’re concerned and confused by Brexit and data, you’re far from alone. 60 percent of respondents were concerned about their ability to transfer data from the EU to the UK post-Brexit, and 61 percent were specifically worried about their ability to back-up data held in the EU. At the same time, 55 percent did not know how Brexit will affect their disaster recovery processes – despite it being potentially only weeks away when the survey took place.

This concern is natural. If the worst does happen the potential impact on UK and European companies – who have up to now relied on the level playing field of EU data protection law to provide the assurance to carry out their processing needs wherever they like across the continent – could still be significant. Potentially as a result of ongoing confusion, a large proportion of enterprises have not yet taken concrete action to prepare for Brexit. 35 percent of respondents did not have preparations in place to alter their processes in response to Brexit, and a further 43 percent had made preparations but had not yet put them into effect. It might also be the case that enterprises think any preparation could ultimately be unnecessary. 59 percent of enterprises worry that the time and money they have put into preparing for Brexit will be wasted.

While it might look like there is light at the end of the tunnel, the simple truth is still that, at present, a large proportion of enterprises are at risk of falling foul of regulations because of inaction. However, it is still not too late for enterprises to prepare. To begin with, you need to make sure you understand data flows, where processing is performed, and where data is stored – including any suppliers that are involved. You then need to decide whether to put in place the correct Standard Contractual Clauses or other agreements to transfer data between the EEA and UK; or to ensure no data leaves the EEA at all. Most importantly, to avoid risk, this needs to be done before October 31st.

Organisations could even see Brexit as a driver to simplify certain data processing operations, whatever the eventual result. For our own part, 4sl’s agnostic approach to where data is stored means we can help clients continue to comply with an evolving regulatory landscape.

For more information on how we can help, don’t hesitate to contact us.

Barnaby Mote