COMPLIANCE: Understanding the European Data Act and GDPR Compliance for UK SMEs

Practical Steps for UK SMEs

1. Conduct a data audit: “Before implementing any compliance measures, you need to understand what data you hold, where it comes from, how it’s processed, and where it goes,” advises Budden. “This foundational step reveals your compliance obligations under both frameworks.”

2. Review cross-border data transfers: With the UK now considered a “third country” by the EU, additional safeguards may be required for data transfers. “International data transfer agreements have become essential components of compliance for many of our clients,” says Budden.

3. Update privacy policies and consent mechanisms: Ensure your documentation reflects compliance with both UK GDPR and, where applicable, EU GDPR and the Data Act.

4. Implement data portability solutions: “The Data Act strengthens requirements around data portability,” Budden points out. “SMEs should ensure they can provide customers with their data in structured, commonly used, and machine-readable formats when requested.”

5. Review contracts with service providers: Cloud service providers and IoT manufacturers now have specific obligations under the Data Act. Budden recommends: “Review your contracts to ensure they address unfair terms and provide mechanisms for data sharing.”

The Cost of Non-Compliance

The financial implications of failing to comply with data regulations can be severe. Under GDPR, fines can reach up to €20 million or 4% of annual global turnover, whichever is higher. The Data Act introduces its own penalties for non-compliance.

Conclusion

For UK SMEs, staying informed about evolving data regulations is not just a legal necessity but a business imperative.

Understanding how the European Data Act interacts with existing GDPR requirements allows UK SMEs to develop comprehensive data strategies that satisfy regulatory requirements while creating value from their data assets.