1.1. The consequences of the ratification of the Withdrawal Agreement, as amended, with regard to international data transfers
If the Withdrawal Agreement, as amended, is ratified, the EU data protection rules will continue to apply in and to the United Kingdom during the transition period, i.e. from the first day of the month following the ratification of the Agreement to 31 December 2020 (except if the transition period is extended pursuant to article 132 of the Withdrawal Agreement, as amended).
Furthermore, the Withdrawal Agreement, as amended, provides that, after the end of the transition period, the United Kingdom must continue applying the EU data protection rules to the personal data exchanged between the United Kingdom and the Members States of the European Economic Area during EU membership of the United Kingdom, until the European Union has established, by way of a formal, so-called “adequacy decision” pursuant to Article 45 of the General Data Protection Regulation, that the personal data protection regime of the United Kingdom provides data protection safeguards which are "essentially equivalent" to those in the European Union.
If the European Commission adopts an adequacy decision, it has to be preceded by an assessment of the data protection regime applicable in the United Kingdom. In the case where the adequacy decision is annulled or repealed, personal data received will remain subject to the same "essentially equivalent" standard of protection directly under the Withdrawal Agreement, as amended.
1.2. Next steps to take for the Luxembourg bodies that are transferring personal data to the United Kingdom if the Withdrawal Agreement is ratified
Companies, public bodies and Luxembourg associations that intend to continue to transfer personal data to the United Kingdom after 31 January 2020, will thus not need to take additional steps, at least until 31 December 2020.
Furthermore, if the European Commission adopts an adequacy decision for the United Kingdom, this decision will allow personal data to flow freely between the United Kingdom and the European Economic Area.
However, these entities must still comply with the general principles of the General Data Protection Regulation and shall apply them when transferring personal data to the United Kingdom (e.g. the principle of lawfulness, the compatibility of the communication with the initial processing activity, information to the data subjects).