This BBC article addresses SMEs and rather optimistically states that "big companies are likely to have addressed this issue".  In our experience, this isn't necessarily true - though not because they haven't been thinking hard about the issue.

Whilst the article is right in that the transfer solution itself (which will often be a suite of signed model clauses) needn't be complex or costly, mapping data flows and corralling group companies and other businesses in the supply chain towards a cohesive strategy to manage cross-border data flows post-Brexit often involves a significant investment of time and resource.  Add to that the considerable uncertainty surrounding the future of 'model clauses' (their validity is being challenged through the Irish and European courts) and it's easy to see why so many businesses (whether SMEs or large global corporates with sophisticated data strategies) have been holding fire on implementing a solution to deal with the impact of a no-deal Brexit on data flows into the UK.  

At this point in time however, it's probably a case of doing something rather than nothing.  Yes, model clauses are clunky and cumbersome and face an uncertain future, but they are likely to be the order of the day for most data transfers impacted by a no-deal Brexit, whatever the size of the business.  Accordingly, where businesses haven't already done so, now is almost certainly the time to grasp the nettle and get on with implementing a solution, even if that solution is inelegant and comes with a degree of uncertainty...