As the UK marches into an election, Brexit uncertainty shows no sign of abating. Depending on the election results, the UK could face anything from a hard Brexit to complete revocation.

For enterprises, this means there is still no cast-iron guarantee that the free flow of personal data between the EU and UK will be allowed once the entire Brexit process is over. If the worst does happen, we could face months or even years before the country regains its data adequacy status. To ensure they can still operate, enterprises may have to make significant changes to their legal arrangements, systems, and processes to avoid the risk of falling foul of regulations.

Fearing the unknown

An inability to transfer personal data could affect many business operations; including backup and recovery. For instance, can an organization transfer data from its European data centers to the UK? Similarly, can a UK-based organization continue to use a European data processor?

While enterprises can prepare for this, there is still plenty of uncertainty in the market. A 4sl survey of UK IT decision-makers this October found that 60 percent were worried about their ability to transfer data from the EU to the UK post-Brexit - and 61 percent were specifically concerned about their ability to back-up data held in the EU. At the same time, 55 percent did not know how Brexit would affect their disaster recovery processes, despite it being potentially only weeks away when the survey took place.

This concern is only to be expected. Up to now, UK and European companies have relied on the level playing field of EU data protection law to provide the assurance to carry out their processing needs across the continent – ensuring they can locate data centers in the most suitable region for the business. In the worst-case scenario, the impact on companies (whether in the UK or the EU) could be significant.

Overriding uncertainty

This lack of preparedness might be because enterprises are still uncertain as to what is needed to ensure they aren’t affected; or because an eventual deal or even revocation will mean that Brexit preparation is unnecessary. As of October, 35 percent of IT decision-makers did not have preparations in place to alter their backup and disaster recovery processes in response to Brexit, and a further 43 percent had made preparations but had not yet put them into effect.

There is also the concern that any investment in preparing for Brexit will be unnecessary – whether because the feared consequences don’t happen, or because preparations turn out to be insufficient. Perhaps because of this, 59 percent of enterprises worry that the time and money they have put into preparing for Brexit will be wasted.

This mentality seems quite understandable, given that the ongoing lack of information and preparedness around Brexit has created real risks for businesses. However, at present, a large proportion of enterprises are putting themselves at risk of falling foul of regulations or failures of critical functions. But is it too late to prepare? Even now, absolutely not.

Taking action

To begin with, organizations need to make sure they understand their data flows, where processing is performed and where data is stored. In addition to this, organizations should seek to understand what legal, technical and operational provisions they need in place in order to continue transferring data - including any suppliers that are involved.

Next, organizations need to be certain that they have either Standard Contractual Clauses or other provisions in place to cover personal data transfers from the EEA to the UK; or that no data is transferred at all. Most importantly, to avoid risk and ensure there is no chance of being caught out, this needs to be done before January 2020.

It's crucial that organizations take steps to avoid the possible pitfalls of Brexit. However, it can also be seen as an opportunity – for instance, by allowing the business to review and simplify data processing operations. Regardless of the eventual result, organizations that have taken the chance to prepare, whether alone or with partners, will be in the best possible position.