5 January 2021

The UK exited the EU on 31st January 2020.  The transition period in the Withdrawal Agreement ended on 31st December 2020. Existing EU Treaties, EU free movement rights and the general principles of EU law now no longer apply in relation to the UK. EU regulations only continue to apply in UK domestic law (by virtue of the European Union (Withdrawal) Act 2018) to the extent that they are not modified or revoked by regulations under that Act.

The EU and the UK negotiating teams have agreed the terms of a detailed post-Brexit Trade and Cooperation Agreement which has been given effect from 1st January 2021.  

Technology and Communications businesses need to be aware of the implications for their businesses arising from the UK’s status as a “third country” outside the EU. 

The following areas are outlined in this note:

This Checklist is an update to the Checklists previously issued by Bird & Bird in 2018 and 2019.


The EU-UK Trade Agreement does not include any provisions for conferring new immigration rights or residency. The UK left the EU single market at the end of the transition period, including the free movement of people. 

Since March 2019, the UK Government has committed to protect the rights of EU nationals and their family members who wish to stay in the UK. The EU Settlement Scheme ("Scheme") requires EU nationals to register in order to preserve their rights under UK law (including rights to work, pensions, healthcare and other benefits). The Scheme is mandatory for all EU nationals who wish to continue living in the UK. Home Office guidance on the Scheme is available here.

EU citizens lawfully resident in the UK at the end of the transition period will continue to receive access to NHS-funded healthcare in England but they will need to be able to provide evidence that they are lawfully resident in the UK and that they were residing in the UK at the end of the transition period.  They must register their new status under the Scheme by 30 June 2021.

Organisations with EU nationals working in the UK should implement a communication plan to inform and support employees with Scheme registration. We encourage businesses to take proactive steps at this stage to ensure their EU national employees retain the right to work in the UK and avoid business interruption. 

Businesses with British Citizen employees residing and working in EU Member States should also ensure that affected individuals have complied with national requirements to protect their continued right to reside and work in that Member State after the end of the transition period.  In particular, cross-border workers based in the UK (who are British Citizens) but who work in multiple EU Member States will need to carefully plan their future activities following the cessation of freedom of movement on 31 December 2020.  They may need to obtain multiple work permits, visas and/or residence permits in order to work at client sites in EU Member States.

The UK Government has implemented a new set of Immigration Rules which will apply to all non-UK nationals. The Home Office is now accepting applications for the new Skilled Worker and Intra-company Transfer visa routes, subject to the grant of permission beginning from 1 January 2021.

For employers, the overall message is clear. The Home Office has effectively rolled back most of the restrictions placed on work visas since April 2011 and it will be much easier to sponsor non-UK nationals as new hires from January 2021. Whilst the work visa threshold has been lowered, employers should be mindful of the disproportionate impact and increased compliance measures following the introduction of the new Immigration Rules. 

For more information click here

Data protection

EU to UK data transfers: The departure of the UK from the EU on 31 January 2020 has not led to dramatic immediate changes in UK data protection law.  The GDPR has been enacted into UK law as the UK GDPR and will continue to sit alongside the Data Protection Act 2018. The EU GDPR will however continue to apply to UK organisations which trade in the EU to the extent any of their processing activities are caught by the extra-territorial provisions set out therein.

Transfers of personal data from the EU to the UK constitute a transfer of personal data to a "third country".  As the UK does not (yet) have an adequacy decision, this would usually mean using “appropriate safeguards” or relying on a derogation to the restrictions.  However, the EU-UK trade agreement includes a temporary arrangement allowing personal data to continue to be transferred from the EU to the UK for a period of 4 months from the end of the transition period (extendable up to 6 months).  During this period alternative safeguards, such as Standard Contractual Clauses (SCCs) are not required to legitimise the data transfers. 

This arrangement is conditional on the UK not amending its data protection legislation or exercising certain “designated powers” during this period. These powers are – broadly – doing anything new relating to data transfers. If the UK does want to take action during this period, then it can do so with the approval of the TCA Partnership Council. There is an exception for UK amendments which are limited to changes to align rules with those applicable in the EU. 

The European Commission has published a draft implementing decision relating to new standard contractual clauses for data transfers. If the EU adopts these new clauses, this exception would allow the UK to adopt the same updated clauses, should it wish to do so. 

For more detail, please see our recent news alert here.

Data transfers from the UK: The UK will continue to treat EU countries' laws as adequate for the purposes of the UK GDPR and the Data Protection Act 2018. On this basis, transfer adequacy mechanisms are not needed for UK to EU data transfers.

Personal data transfers to other jurisdictions need to comply with the UK GDPR and Data Protection Act 2018 obligations. Essentially these are as per the pre-Brexit position and the UK Government has confirmed that EU adequacy decisions, approved EU SCCs and BCRs are recognised in the UK to legitimise data transfers to non-adequate countries. Transfers to Gibraltar will also be allowed to continue. 

Organisations which rely on Binding Corporate Rules for their data transfers will be aware of the need to adjust their BCRs so that, as from 1st January 2021, they meet both EEA and UK requirements. Recent Brexit related legislation in the UK requires organisations which have BCRs which were approved under the Data Protection Directive, by an authority other than the Information Commissioner, to resubmit their BCRs to the Information Commissioner by 31st June 2021. The Commissioner is then required to decide whether or not to approve the amended rules and to notify the organisation accordingly without delay.

Lead supervisory authority and representative issues: The GDPR "one stop shop" no longer applies in the UK for investigations that have a multi country dimension. EU regulators will no longer be bound to act through the ICO, even when a business has its overall European headquarters in the UK. Conversely, for organisations with their "main establishment" in one of the remaining EU countries, the ICO will no longer be bound by the GDPR's consistency mechanism. In either case, this means that organisations could face distinct investigations and sanctions in the UK and the EU. In a large scale data breach, for instance, both the ICO and at least one EU regulator may need to be notified with details of the breach, and each could follow up with distinct investigations and sanctions (such as fines). 

The situation is more problematical for EU-active, UK-headquartered businesses unless they can position one of their other (non-UK) EU presences as their "main establishment" in the EU. For offshore (i.e. non-EU) businesses without a "main establishment" in the EU, the EU GDPR's "consistency" rules do not apply; so in a data breach scenario, the UK-headquartered business might have to notify (and then cooperate with investigations by) regulators in every relevant EU / EEA country (plus the UK, if the UK is relevant).

To avoid that worst-case outcome, many UK-headquartered multinationals are therefore looking at how best they can position a subsidiary in the EU as their "main establishment" in the EU; for efficiency, businesses might even decide to shift control of data protection matters entirely out of the UK, rather than split control between the UK and the EU.

UK businesses without an EU presence but which process the data of EU-based individuals (e.g. their online customers) need to consider the GDPR's requirements to appoint an EU representative, including so that the representative can deal with regulators on their behalf. The same is also true of EU businesses which process the personal data of UK-based individuals but don't have a UK presence. They need to appoint a UK representative.

Click here for more information on how Brexit can impact Data Protection and Cyber Security.

Trade, tax and tariffs

Multinational tech companies should review their international strategies to determine whether, and to what extent, they continue to use UK group companies as a gateway to the EU, particularly as companies within the EU will no longer be able to rely on EU directives to eliminate withholding tax on dividend, interest or royalty payments to the UK.

The EU-UK Trade Agreement establishes that trade between the EU and UK and vice versa from the end of the transition period is tariff and quota free. For most Tech companies this does not make a change from the situation that would have applied under WTYO rules in the absence of an EU-UK Trade Agreement.  Under WTO rules, the 1996 WTO Information Technology Agreement eliminates tariffs on a broad range of high technology products including packaged software and computer hardware, cloud-based or sold on physical media.  Also, SaaS and other IT services (e.g. consultancy) fall under the General Agreement on Trade in Services (GATS) which specifies generally that the international sales of services between WTO members are tariff-free.

Customs declarations and procedures are necessary for the import and export of goods into and out of the EU and GB. Northern Ireland has a special position.  The Northern Ireland Protocol establishes that Customs declarations and procedures are not necessary for the import and export of goods between Northern Ireland and the EU.

Businesses which have relied on a UK-based Mini One-Stop Shop (MOSS), enabling businesses to register and account for VAT on all relevant supplies throughout the EU via a single registration for sales to EU customers, will need to register in an EU jurisdiction.  The UK is no longer part of the MOSS scheme.

UK businesses trading goods with the EU should review their supply chains and consider how they will handle the logistics of import and export declarations and procedures. In particular, UK businesses trading goods with the EU must have an Economic Operator Registration and Identification (EORI) number.  This is essential in order to import into or export goods out of the EU into the UK.

Between 1 January 2021 and 30 June 2021 HMRC will introduce a new simplified import customs clearance system – Customs Freight Simplified Procedures/Entry In Declarants Records (CFSP-EIDR).  Under CFSP-EIDR importers will have six months to present the import entry, but importers must keep records of arrivals. The system will be available to all companies and importers without the need to apply for it. From 1 July 2021, full import customs clearance formalities will apply (Form C88). Full Export declarations for exports from the UK to the EU will be required from 1 January 2021. Safety & Security declarations will not be required for imports to the UK until 1 July 2021 but will be required for exports from the UK to the EU from 1 January 2021.

For more information on future trading arrangements click here.


The EU-UK Trade Agreement does not include any provisions relating to the enforceability of business contracts or the mutual recognition and enforcement of judgments. 

Existing commercial contracts should be reviewed, particularly those involving contracting entities in the UK and the EU, in order to assess the on-going enforceability of English law contracts where there is a non-UK element to the contract – see the comments on enforceability later in this section. 

Following an influx of hastily drafted "Brexit clauses", disputes are likely to arise as to their enforceability or otherwise. Where there has been a reliance on more general "force majeure" clauses, there is also a chance of disputes arising concerning their interpretation. A third problematic area is where contracts include territorial definitions which have been based upon the EU territory but are intended to include the UK.

On the choice of governing law in contracts, Rome I and Rome II, the EU Regulations which currently govern the choice of law of contractual and non-contractual obligations, have been incorporated into UK law and therefore will continue to apply. This means that the position in relation to governing law will not change.

The position on determining the jurisdiction of a court to hear a dispute and the enforceability of any resulting judgment is less straightforward.  Current EU law will continue to apply to legal proceedings issued in the UK before the end of the transition period and (in principle at least) to the recognition and enforcement of judgments given in legal proceedings before the end of the transition period with the proviso that, whilst the UK government has stated that the current enforcement provisions will remain in place for any judgment given prior to this date, the EU Commission has said that it will depend on what stage of the enforcement process the judgment has reached.

For new cases, unlike with governing law, the current rules on jurisdiction and enforceability cannot just be replicated into UK law, as they rely on reciprocity.  One partial solution is for the UK to accede to The Lugano Convention 2007 (which it officially requested to do on 8 April 2020). This would be welcome as Lugano provides a reciprocal arrangement in the areas of jurisdiction and the enforcement of judgments on a broadly similar basis to that in operation between the UK and the EU prior to the end of the Brexit transition period. However, accession to the Convention depends upon consent from the other signatories and, currently, the EU and Denmark continue to withhold their support. The EU UK Trade Agreement has not changed this and, even if consent is obtained in the future, an accession process which takes three months would need to be followed, and there would still be some significant gaps between the Lugano regime and the EU enforcement regime.

In the absence of Lugano, The Hague Convention on Choice of Court Agreements is applicable from the end of the transition period. This provides a partial solution to questions of jurisdiction. The Convention provides a worldwide framework of rules in relation to exclusive choice of court (jurisdiction) clauses only and the recognition and enforcement of judgments based on these clauses in civil and commercial matters. It does not, however, apply to asymmetric jurisdiction clauses, or to enforcement of interim remedies. Under the Convention courts in EU Member States (and the other contracting states to the Hague Convention) are obliged to honour exclusive choice of court agreements designating UK courts, and to enforce the resulting judgments. However, whilst it appears that English courts will respect an exclusive choice of court provision in contracts entered into from 1 October 2015 onwards, EU member state courts may regard the Convention as applying only to contracts entered into from 1 January 2021. 

As a side note, a new Hague Convention on jurisdiction was drafted in 2019.  This proposed convention has a far wider scope than the 2005 Hague Convention in that it deals not just with exclusive jurisdiction clauses and, if ratified (not something that is expected for some time), may have the effect of harmonising this area between the UK and the EU.

Where the 2005 Hague Convention does not apply, the English courts will instead apply common law rules to determining questions of jurisdiction and enforcement, which are generally less predictable than the Brussels/Lugano regimes.  

Practically speaking, permission to serve a claim outside of the jurisdiction will almost always be required (unless the 2005 Hague Convention applies) and older conventions between the UK and the EU Member States on service abroad/taking evidence abroad will now apply once more.  

If it is a priority to be able to obtain a judgment under an English law contract that can be enforced in the EU without difficulty, it is imperative to seek advice as to whether an exclusive jurisdiction clause drafted in favour of the English courts would be enforceable in the desired way under the 2005 Hague Convention.  If not, other options worth considering are choosing another EU Member State to have exclusive jurisdiction or considering an arbitration clause instead.  

Online Tech Services - Regulatory Compliance (eCommerce Directive)

The eCommerce Directive no longer applies to the UK. 

Article 3 of the eCommerce Directive provides a form of “passporting” protection for EU established online service providers (including cloud solution providers) by allowing them to operate in any EEA country while only following relevant rules in the country in which they are established. Article 4 of the eCommerce Directive states that EU service providers that provide services in a regulated field, such as financial services, only need to obtain prior authorisation to do business in the country where they are established. 

As the eCommerce Directive no longer applies in the UK these protections are no longer available for UK companies that provide online services across the EU. The loss of these protections means that online service providers based in the UK and providing services to customers across the EU need to comply with the national rules applicable to their services in each EU country where their services are available.  Similarly, EU service providers doing business in the UK need to consider and take steps to comply with the UK law applicable to their services.

As an alternative, online service providers should consider if they are already EU established or if they could become EU established in order to benefit from the “passporting” provisions of the eCommerce Directive.

For additional information on the implications of the end of the eCommerce Directive in the UK click here.

Trade marks and other IP Protection

Trade Marks

Tech companies should identify which of their business' trade mark rights are likely to be affected by the UK's departure from the EU and may need further application/registration in order to achieve maximum protection over those rights; as set out below, the opportunity to make any further applications or registrations in the normal way has run out so any anomalies should be addressed and rectified as soon as possible to minimise the risk of losing existing or potential rights. 

As the transition period has now ended, EU Trade Marks (EUTMs) and Registered and Unregistered Community Designs no longer have effect in the UK. The UK Government has automatically created a comparable UK trade mark for every registered EUTM, at no charge, with effect from the end of the transition period. The same will apply for Registered Community Designs (RCDs). However, this does not apply to pending EUTM applications, so tech companies with pending applications should apply to register a comparable UK trade mark as soon as possible.

There is,  therefore, technically no need for tech companies with EUTM and RCD registrations which existed at the end of the transition period to re-file for equivalent registrations in the UK, as comparable UK registrations have been automatically granted., For new filings, however, tech companies are advised to dual-file in the EU and UK if protection is needed both in the UK and the EU. Tech companies should also review the following:

  • Whether they have any pending oppositions/cancellation actions at the EUIPO: actions which were only based on UK rights will have fallen away and parallel actions against the new comparable UK trade mark will need to be brought.
  • Whether their existing EUTM legal representatives will remain entitled to represent them before the EU IPO and the UK IPO after the end of the transition period. Bird & Bird will be able to represent clients before both the UK and the EU IPOs.
  • Their broader enforcement strategy: pan-EU injunctions no longer cover the UK and will not be available in the UK, meaning that separate EU and UK proceedings need to be brought to cover all of Europe.
  • Whether they have an EU customs notice ("Application for Action") in place which was filed via UK Customs: these have fallen away at the end of the transition period and need to be renewed/re-filed via one of the remaining EU countries. A UK filing will also be needed.
  • Whether they have hardware businesses affected by parallel imports between the UK and continental Europe: the ability for trade mark owners to prevent imports from one territory to the other will differ depending which way the goods are going.
  • References to the EU in brand licence agreements will need to be considered to ensure that the territorial provisions continue to reflect the commercial need and understanding.
  • Patents will to a great extent continue as before - patents covering the UK will continue to be granted both by the UK Intellectual Property Office (UKIPO) and the European Patent Office (EPO). Applications for patents can be filed directly with the UKIPO or EPO, or can be made pursuant to an international patent application filed under the Patent Cooperation Treaty. Neither UKIPO, nor the EPO, is an EU institution and their operation will be unaffected by Brexit.

The UK will continue to be one of the 38 contracting state to the European Patent Convention, which is the international treaty that established the EPO. Applicants will continue to be able to file their applications with the EPO and, on grant, request validation in the UK and other countries of interest.

The standing of granted patents will also be unaffected by Brexit. Following grant and validation in the UK, European patents have – and will continue to have – exactly the same legal effect in the UK as national patents granted by the UKIPO.

Furthermore, the UK will remain a member of the Paris Convention, which supports IP protection around the world. Applicants who have filed for patent protection in the UK will still be able to subsequently claim the priority of that application for a patent registration in other countries and vice versa.

For additional information on what to consider in regards to IP click here.

Software export controls

Export controls apply generally to items that are specially designed or modified for military use and to items designed for civilian use which have potential military uses ("dual-use" items). Some software is subject to EU export control as dual use items, including many commonly used encryption protocols, unless the products are specifically excluded (such as smart cards and smart card reader/writers and mobile telephones for civil usage) or are excluded as being generally available to the public at retail selling points. 

The EU Dual Use Regulation has been incorporated into UK law. However, the UK is now regarded by the EU as being a third country for the purposes of EU export control. The EU General Export Authorisation (GEA) for the export of all dual use items (including encryption software) has been amended to include exports from the EU to the UK. Exporters of dual use software from the EU to the GB (that is not exempted) must notify the relevant national competent authorities of the first use of the GEA and EU Member States may require registration prior to first use of the GEA.

For transfers from GB to the EU, the UK has issued an Open General Export Licence (OGEL) to cover the export of dual use items (including encryption software) from the UK to the EU. The OGEL has conditions and does not apply if the exporter is aware that the dual use item is intended to be used in certain weapons systems. Companies need to pre-register with the Department of International Trade for each product for which the OGEL is relied on and must comply with the terms of the OGEL, including a requirement to include a note on official export documentation that the items are exported under the OGEL.

Conformity Assessments (CE marks)

Conformity assessments carried out by UK conformity assessment bodies prior to the end of the transition period are no longer valid for EU purposes. Instead, EU conformity assessments need to be carried out by EU-based bodies. Where companies hold existing certificates issued by a UK conformity assessor they need either to apply for a new certificate from an EU-based conformity assessor or to arrange for a transfer – with the EU Conformity Assessor then taking over the responsibility for that certificate.

In the UK, in most instances until 1 January 2022, it will be possible to use the EU CE mark when placing products on the UK market (if the product meets the relevant EU requirements), including where products have had a third-party assessment carried out by an EU-recognised body. The new UK Conformity Assessed (UKCA) mark will also be available for products that require third party assessment of conformity within the UK. This will need to be carried out by a UK-based Approved Body. After 1 January 2022 a UKCA marking will be required, declaring conformity with the UKCA marking regulations instead of the EU directives and regulations.

UK manufacturers exporting products to the EU must appoint an importer. Similarly, products from the EU placed on the UK market will require a UK importer.

Importers must:

  • Mark the product with their name and address;
  • Understand and check the markings, declarations and technical file;
  • Satisfy themselves that the CE or UKCA marking process is complete;
  • Be the primary point of contact for the EU or UK authorities; and 
  • Be prepared to cooperate with the authorities if there is a product recall or similar.


The EU Geo-Blocking Regulation prohibits, amongst other matters, blocking access to, or forced redirection away from, a website on the basis of an internet user's EU nationality or place of residence within the EU.  The EU Geo-Blocking Regulation has been revoked in the UK with effect from the end of the transition period. 

As a result, companies are not prohibited from discriminating in the UK between EU customers and UK customers in their on-line businesses. Within the EU27 the EU Regulation will continue to apply to UK businesses, meaning that UK companies will not be able to discriminate between customers in different EU Member States.


Companies operating in the UK and the EU should consider potential exposure to parallel investigations by the European Commission and UK Competition and Markets Authority (CMA) and the need to safeguard their position under both the UK and EU regimes.
They should re-assess territorial restrictions in agreements, as between the UK and the EU, under the anti-trust rules as from Brexit. More generally, companies should be aware that the Competition (Amendment etc.) (EU Exit) Regulations 2019 will adapt EU competition regulations and have become a set of domestic regulations.

If you are planning a large-scale merger or acquisition, consider whether it will be subject to merger control scrutiny by both the UK CMA and the European Commission, as the Commission will no longer be a "one stop shop" for large mergers affecting the UK, as from Brexit.

Read more on the competition law implications here

How Bird & Bird can help

Bird & Bird has a range of tools to help businesses prepare for the commercial impact of Brexit, this includes:

  • Our Brexit Briefings that offer further information about the ramifications of Brexit on a particular sector or area of law
  • Our Brexit Jargon Buster for simple explanations that help you get to the heart of the issues in the Brexit debate.
  • Our Commercial Drafting Checklist which highlights Brexit-related issues for businesses to consider when contracting during this period

Further Alerts and Briefings will be issued by Bird & Bird on our dedicated Brexit Portal as these issues become clearer.

For further information and advice on these topics please contact one of our specialists