The prospects of the UK not being granted an adequacy decision seems in many quarters to be inconceivable.  If we work within the GDPR framework on 31^st December, why would anything be different on 1^st January?  But the Outsourced DPO believes it is far from nailed on.  The recent examination by the CJEU of national security surveillance measures certainly puts a UK adequacy decision under some pressure as does the apparent pace of the trade negotiations.  It’s not necessarily the “UKGDPR” at issue, it is other legislation that is thought to undermine individual rights, transparency and accountability.

We should not forget the infraction proceedings that rumbled on for years regarding the old Data Protection Act: what we consider to be good law and an accurate interpretation of EU rules, isn’t necessarily felt on the other side of the North Sea.  With only 72 days until the end of the transition period, DPOs should be planning for both eventualities: adequacy and no adequacy.