UK companies face £1.6 billion in extra costs without EU data sharing agreement

The average compliance cost is estimated to be £10,000 for small firms and over £160,000 for large businesses

British firms face a massive increase in costs if a data sharing agreement is not reached with the European Union, a report by the New Economics Foundation and UCL's European Institute has warned.

The NEF and UCL wrote the report [pdf], which looks at the impact of EU data rules in the event of a no-deal Brexit, following interviews with more than 60 data protection officers, legal experts, academics and business representatives from the EU and the UK.

They found that British companies risk costs between £1 billion and £1.6 billion - unless the UK can show the EU that it has appropriate measures in place to protect users' data and privacy.

Earlier this year, the UK government published an explanatory framework for post-Brexit data flows between the EU and the UK.

In the event of a no-deal Brexit, UK firms - which currently transfer data between the EU and the UK - will be excessively affected and are likely to face new legal fees, according to the report.

It estimates the average compliance cost to be £3,000 for micro firms, £10,000 for small, and £20,000 for medium-sized business. Large enterprises will face about £163,000 in legal fees.

"This extra cost stems from the additional compliance obligations - such as setting up standard contractual clauses (SCCs) - on companies that want to continue transferring data from the EU to the UK.

"We believe our modelling is a relatively conservative estimate as it is underpinned by moderate assumptions about the firm-level cost and number of companies affected."

There is also a possibility that many British SMEs will not be able to pay the compliance costs that accompany contractual clauses.

The report authors warn that the total costs could deprive businesses of investment in new technology, research and staff at a critical time. Data centres, digital technology, and financial services are likely to be the worst hit in that situation.

The report says the UK government must provide proper guidance to SMEs, and support them financially in the event a data agreement is not reached with the EU.

It also urges the government to "consider the impact of future trade agreements on data protection" and to "review the trade-offs involved when liberalising cross-border data flows with different countries".