Data processing could cost small businesses up to £1.6 billion should the UK fail to show the EU that it has adequate levels of data protection, a major study has revealed.
The research, published by University College London (UCL), is the first to analyse the impact on business and the economy should the free flow of data between the UK and the EU cease to exist.
With just weeks to go until the end of the Brexit transition period, the UK Government is still seeking adequacy decisions from the European Commission under both the General Data Protection Regulation and Law Enforcement Directive.
While the Government expects a positive outcome, there is no guarantee there will be a decision before 31 December 2020.
And should the UK fail to evidence adequate levels of data protection – the worst-case scenario – it could cost small businesses between £1 billion and £1.6 billion to put things right.
According to the report, entitled The Cost of Data Inadequacy, the average compliance cost is estimated at £3,000 for micro, £10,000 for small, £20,000 for medium and £163,000 for large businesses.
Commenting on the study, Oliver Patel, Research Associate at the UCL European Institute, said: “In recent years, the European Court of Justice has taken a much tougher approach to restricting data transfers between the EU and other countries, much to the consternation of the business community.
“Post-Brexit, there is a risk that EU-UK data transfers could be targeted by activists and European courts, seeking to exploit the rigid EU rules in this area.”
Co-author Duncan McCann, senior researcher at the New Economics Foundation, added: “Failing to secure an adequacy decision will impose additional costs on UK organisations of over £1b billion, disproportionality falling on SMEs, at a time when the economy is already severely challenged by the pandemic and trading conditions are difficult.”