Powered by Lexis+®
Jurisdiction(s):
United Kingdom
CASE STUDY

“We rely on LexisNexis to give us a definitive answer, quickly and reliable every time so that we can be confident in the advice we use to help our clients.”

Shelter

Access all documents on Safe harbor

Safe harbor meaning

What does Safe harbor mean?
In legal practice, a safe harbour is a rule that limits or excludes liability where stated conditions are met, providing a lower‑risk route to compliance. The expression is descriptive rather than a single defined term; individual safe harbours are set out in particular statutes, regulations or case law across the UK and Ireland. In data protection, Safe Harbor (US spelling) referred to the EU–US Safe Harbor framework that once allowed transfers of personal data from the EU to certified US organisations. The CJEU annulled the underlying adequacy decision in October 2015 (Schrems, C‑362/14). It was replaced by the EU–US Privacy Shield (2016), itself invalidated in 2020 (Schrems II, C‑311/18). Current position: Under the EU GDPR, transfers may rely on the European commission’s 2023 EU–US Data Privacy Framework (DPF) for certified US recipients, or on standard contractual clauses or binding corporate rules, alongside Schrems II transfer risk assessments. Under the UK GDPR, a UK Extension to the DPF (the UK–US data bridge) took effect in October 2023; otherwise use the UK IDTA/Addendum or BCRs. Usage and spelling are consistent across England & Wales, Scotland, Northern Ireland and Ireland; the term also covers other sectoral safe harbours (e.g. intermediary liability, insolvency, competition).
Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

View the related Practice Notes about Safe harbor

PRACTICE NOTES
International data transfers under the UK Data Protection Act 1998 (archived): scope, exceptions, adequacy, Model Clauses, BCRs, Safe Harbor/Privacy Shield, with GDPR comparisons and Brexit considerations

Data export restriction Restriction under the Data Protection Directive Directive 95/46/EC, (the Data Protection Directive) ARCHIVED: This Practice Note outlines the data export limitation under the Data Protection Act 1998 (DPA 1998), which restricts the transfer of personal data to countries outside the European Economic Area (EEA) unless those destinations provide an adequate level of privacy protection. It summarises the data protection framework in place before 25 May 2018 and reflects the position under the DPA 1998. This Note is offered for background purposes only and is not updated... For details on the position under the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), refer to the following Practice Notes: Introduction to the EU GDPR and UK GDPR, which includes a section on international personal data transfers and transfers to international organisations UK GDPR and EU GDPR—transfers of personal data internationally and to international organisations DPA 1998 to GDPR comparison—international data transfers of personal data [Archived] UK data protection law...

Read More Right Arrow
PRACTICE NOTES
US Regulation S explained for UK capital markets lawyers: safe harbours, offshore transactions, directed selling efforts, resale rules and LSE settlement practice

This Practice Note offers a concise overview of the principal features of Regulation S and the practical considerations of relying on Regulation S for English and other non‑US lawyers; it is not intended as an exhaustive discussion of Regulation S. Background and scope of Regulation S Adopted in 1990, Regulation S was introduced to clarify the extraterritorial reach of the registration and prospectus delivery obligations under the US Securities Act of 1933, as amended (the Securities Act). The rule rests on a straightforward principle: any offer or sale of securities conducted within the United States of America (United States) is potentially subject to the registration and prospectus delivery requirements of Section 5 of the Securities Act (Section 5), while any offer or sale made outside the United States is not. Putting that premise into practice for international offerings is more complex. Regulation S sets out two non‑exclusive safe harbours for particular transactions: one primarily for issuers and distributors of securities, and another for resales of...

Read More Right Arrow
PRACTICE NOTES
EU Standard Contractual Clauses (Model Clauses) under the UK Data Protection Act 1998: types, practical use, amendments, EU-US issues and GDPR transition [Archived]

This archived Practice Note sets out information on the data protection landscape before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). It is provided for background only and is not maintained. From 25 May 2018, the General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), introduced significant reforms to EU and UK data protection law, replacing the DPA 1998 and Directive 95/46/EC (the Data Protection Directive). For later guidance on Model Clauses under the GDPR, see Practice Note: UK GDPR and EU GDPR—transfers of personal data internationally and to international organisations—Article 46 tools... Model Clauses—an overview This practice note outlines the EU Standard Contractual Clauses (also referred to as Model Clauses) that have been approved by the European Commission (the Commission). These standard-form clauses enable organisations to transfer personal data to a non-EEA third country that has not received an adequacy decision from the Commission. The Practice Note describes the categories of Model Clauses available and how to implement them in...

Read More Right Arrow