International Transfers of Personal Data - Update to EU Adequacy Decisions

Mirroring the EU regime, the UK GDPR contains rules about the transfer of personal data from the UK to receivers located outside the UK.

These rules apply where the receiver and the sender of the data are controlling or processing the data separately, which will cover most data processing arrangements, including intra-group transfers.

A transfer of personal data to a receiver located outside the UK is known as a 'restricted transfer'. If you are looking to make a restricted transfer, you should ask yourself the following questions to determine if and how you are able to make this transfer.

If there is no UK adequacy decision in place in the intended recipient territory, or if the organisation receiving the personal data does not participate in any required certification scheme, then the transfer may still be allowed subject to the use of 'appropriate safeguards'. The list of appropriate safeguards is set out in Article 46 of the UK GDPR.

These ensure that both the sender and receiver are legally required to protect people’s rights and freedoms in respect of their personal data. Before relying on any of these safeguards, a Transfer Risk Assessment must be undertaken to make sure the required level of protection will be provided for the people whose data is being transferred.

The safeguard mechanisms are that a restricted transfer can be made if:

1. It is covered by a legal instrument between public authorities or bodies containing ‘appropriate safeguards’ (these must include enforceable rights and effective remedies for people whose personal data is transferred).
2. UK Binding Corporate Rules are used to provide appropriate safeguards.
3. The sender and receiver have entered into a contract incorporating standard data protection clauses recognised or issued in accordance with UK data protection law (being the International Data Transfer Agreement or the UK Addendum to the European Standard Contractual Clauses). This is the most common mechanism for making an international transfer between two businesses.
4. The receiver has signed up to a code of conduct, which has been approved by the ICO and has appropriate safeguards to protect the rights of people whose personal data is transferred.
5. The receiver has a certification under a certification scheme approved by the ICO and has appropriate safeguards.
6. The sender and the receiver have entered into a bespoke contract governing a specific restricted transfer, and that contract has been individually authorised by the ICO for that restricted transfer.
7. It is covered by an administrative arrangement between public authorities or bodies approved by the ICO and has appropriate safeguards.

The DUA Act updates data protection laws in the UK and reforms how the UK manages non-personal and personal data. These changes will be phased in between June 2025 to June 2026.

International transfers of personal data will be affected as follows:

• The standard of protection that is required for transfers to third countries and international organisations has been updated via a new data protection test which requires that the standard of protection in the recipient country to be “not materially lower” than the standard of the protection provided under the UK GDPR and the DPA 2018.
• Organisations are now formally required to satisfy the data protection test “reasonably and proportionately” by carrying out a risk assessment.
• The schedule also outlines the factors that the Secretary of State must consider when deciding whether the data protection test is satisfied.
• The Secretary of State also has new power to recognise new transfer mechanisms (in addition to those set out above).
• The review period for transfers approved by regulations has changed from four years to “ongoing monitoring”.