News that the UK and EU have reached an agreement (in principle, as it still needs to be ratified by both sides) on trade following expiry of the Brexit transition period came as an early Christmas present to many, including the data protection practitioners amongst us (sort of).
The EU has not granted the UK adequacy status (yet), but the trade agreement will, in effect, extend the existing transitional arrangements for four months (which can be extended by a further two months), provided the UK's data protection legislation doesn't diverge in the meantime (Article FINPROV.10A). So, for now, we have some breathing space; there's no need to put in place safeguards (e.g. Standard Contractual Clauses) to legitimise the transfer of personal data from the EU to the UK (transfers the other way are unlikely to be restricted, unless the UK changes its stance on this).
Will an adequacy decision for the UK follow in 2021? Hopefully, but there are no guarantees, so organisations should continue to prepare for the possibility that the UK will be treated as a non-adequate 'third country' in Q3 2021.
FINPROV 10.A 1. For the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law, provided that the data protection legislation of the United Kingdom on 31 December 2020... applies and provided that the United Kingdom does not exercise the designated powers without the agreement of the Union within the Partnership Council. ... 4. The “specified period” begins on the date of entry into force of this Agreement and, subject to paragraph 5, ends: (a) on the date on which adequacy decisions in relation to the UK are adopted by the European Commission under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of Regulation (EU) 2016/679, or (b) on the date four months after the specified period begins, which period shall be extended by two further months unless one of the Parties objects; whichever is earlier.