The last minute Brexit deal has some good news for those organisations who are working with companies in the EU or whose cloud storage is based in the EU. Up till now the Uk and EU/EEA have been able to exchange personal information without any issues or concerns. As part of the new Brexit deal that exchange can continue unhindered until the UK achieves adequacy status but no longer than six months. This means that you do not need to use the Standard Contract Clauses when working within the EU or EEA currently.

For information the exact reading of paragraph 182 of the Brexit deal states “This Part also includes a provision to provide for the continued free flow of personal data from the EU and EEA EFTA States to the UK until adequacy decisions are adopted, and for no longer than 6 months. The UK has, on a transitional basis, deemed the EU and EEA EFTA States to be adequate to allow for data flows from the UK.”

Regarding whether you should update your policies and procedures as a result of Brexit, I would probably wait to see what happens in the next six months regarding the adequacy decision and how things develop. That way you will only need to review your policies once in light of any changes rather than changing them now and again when things are clearer.

Nothing about the exchange of information from the Uk to countries outside the EU/EEA or those with an adequacy decisions changes.