The prospect of a no-deal Brexit is creating new risks for companies that are required to comply with European data-protection rules. If the U.K. separates from the European Union on March 29 without a withdrawal agreement, data transfers from the bloc to the U.K. won’t automatically comply with the EU’s strict privacy laws. That leaves executives with a choice: make last-minute changes to legal contracts or risk incurring steep fines. The EU’s General Data Protection Regulation, or GDPR, threatens noncompliant companies with fines of up to 4% of global annual revenue, or €20 million ($22.4 million), whichever is higher. About 200,000 GDPR cases have led to about €55.9 million in fines, according to the European Data Protection Board. Under a disruptive Brexit, data transfers to the U.K. from the EU will no longer be covered by GDPR, according to the European Commission, forcing companies to draft and incorporate alternative legal clauses. Bringing a company into compliance isn’t overly complex, lawyers say. But the exercise would be a burden on companies already struggling to prepare their operations for Brexit. The U.K. is currently covered by GDPR and has pledged to stick to the existing data protections. But the EU won’t immediately deem the country’s regulation as equivalent, creating a gap that could last a year or two until the EU grants the U.K. equivalent status, said Jane Shvets, a partner at law firm Debevoise & Plimpton LLP. The U.K. said it considers the EU’s data protections as equivalent. Companies therefore don’t need to make any change to contracts governing data transfers to the EU from the U.K. The U.K. parliament will revisit the government’s Brexit deal on Tuesday. Prime Minister Theresa May has offered concessions to parliamentarians, including a short delay of Brexit. A delay, however, “cannot take no deal off the table,” Ms. May said in February. Preparing legal contracts for a no-deal Brexit scenario will be a “depressing exercise that involves a lot of companies putting in place a lot of paperwork,” said Nigel Parker, a partner at Allen & Overy LLP. The contract changes don’t improve citizens’ data protection, but merely fulfill a regulatory purpose, the lawyer said. As the possibility of a no-deal Brexit has increased, companies have paid more attention to its implications for GDPR, he said. “Until very recently, no one had done anything about this,” Mr. Parker said. Large companies typically have hundreds of agreements covering the use of personal data, including those with third-party suppliers. These contracts have to be altered in case of a no-deal Brexit, Mr. Parker said. Firms could expect to spend up to 20 hours per contract and invest hundreds of thousands of U.S. dollars to remain GDPR-compliant—an effort that might be in vain should the U.K. not opt for a no-deal Brexit, Mr. Parker said. Munich-based Siemens AG is among the companies preparing to alter its contracts. It has binding corporate rules governing internal data transfers that won’t be affected by Brexit, but the company will agree to new standard clauses for personal data transfers involving third-party suppliers before March 29, a company spokesman said. “There is a silent majority of companies that are not doing this, even though it would be the prudent thing to do,” Ms. Shvets said. Some firms will make the changes no matter what, Mr. Parker said. “We have clients that are under a lot of pressure to be compliant,” he said. There is a precedent for the challenge facing executives. In 2015, the Safe Harbor data-exchange agreement between the U.S. and the EU was declared invalid, forcing many companies to put in place temporary clauses to make sure they were compliant with the ruling by the European Court of Justice. In the Safe Harbor case, however, a replacement—the EU-US Privacy Shield—was agreed to several months after the court decision, limiting the time gap. Companies don’t lose much other than time and money if they put new clauses in place and a no-deal Brexit doesn’t happen, Mr. Parker said. “In that case, the clauses would just fall away,” he said. Lawyers expect European regulators to be lenient with companies that haven’t updated their contracts the day after a no-deal Brexit. Most GDPR cases are brought by individuals, and it remains to be seen whether anyone will file claims over what experts say is a procedural issue. But some companies won’t be willing to expose themselves to the risk. “Post-GDPR, companies are much more nervous about potential fines,” Mr. Parker said. Write to Nina Trentmann at Nina.Trentmann@wsj.com
Businesses risk non-compliance with the EU's General Data Protection Regulation (GDPR) if they transfer data from the EU to the UK after 29 March, in a no-deal Brexit scenario. Non-compliance with GDPR can lead to a fine of up to 4% of global annual revenue, or €20m ($22.6m), whichever is higher. However, EU regulators are likely to be lenient if companies have not updated clauses in their contracts immediately after a no-deal Brexit. Furthermore, the majority of GDPR complaints are brought by individuals who may not consider this cause of non-compliance as serious as others.