Starting Term with a Bang! – SchoolPro TLC Monthly Newsletter – Issue 3 – November ’19

Brexit and Data Protection

Back in March, we issued the following advice to schools with regards to Brexit preparation and data protection:

“If we leave with no deal, schools may experience difficulties accessing data if it’s held on servers in another EU member state, because the UK will be considered a ‘third country’ for data processing purposes. For example, your school may use a cloud storage facility that’s provided by a company which has its servers in an EU member state (including the Republic of Ireland).

Our advice would be to speak to your ICT support provider and ask them to double check the data storage arrangements for the software systems that you use and identify if there are data transfers occurring outside the UK. You should ask them to ensure that your ability to function will not be impaired by any potential issues with data transfers as a result of a no-deal Brexit.

It is important to note that this is only in the event of a no-deal Brexit. If the withdrawal agreement is passed, there won’t be any immediate changes to data protection law and your school can continue processing data in the same way until the end of the transition period.“

Fundamentally, this advice has not changed. There is even more advice now published about how to deal with Brexit but, from a data point of view, the biggest impact will be if a no-deal exit occurs. And this will predominantly affect you receiving data from the EU if, for example, you are arranging exchanges or ski trips within the EU, or, as we said in our previous advice, if you have data stored in another EU country. If you are likely to be receiving data from a data controller within the EU (not from an individual but an organisation), then you will need to ensure that you have the appropriate standard contractual clauses (SCCs) in place if they aren’t already. 

We are more than happy to support schools with this process should a no-deal exit look likely again. The most likely scenario at the moment seems to be that we will leave with a deal which should mean business as usual for your data, at least until the end of the transition period, currently scheduled to the end of 2020 but possibly as late as 2022!

Further advice can be found here:

Prepare Your School for Brexit – DfE’s general Brexit guidance for schools
Brexit Guide: Data Protection for Education Providers – DfE’s guidance on data protection and Brexit for education providers
Data Protection and Brexit – ICO’s advice on Brexit