Artifact GuideUKAdequacy

UK GDPR Adequacy

A UK transfer approval is usable only when regulations in force cover the exact destination and transfer. Record the scope check before treating Article 45A as the transfer route.

Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 16, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 16, 2026

Overview

Since 5 February 2026, Article 45A calls this route a . The familiar term 'adequacy' is still useful, but the binding test is now in Article 45B: protection for people must not be materially lower than UK protection when considered as a whole. Check the exact destination, recipient, data and sector covered by the regulations before relying on them.

Section 1

What is a UK GDPR adequacy decision, and why does it matter for international transfers?

Under Articles 45A-45C, the Secretary of State may approve transfers to a third country or international organisation by regulations after applying the Article 45B data protection test. Approval may cover all transfers or only specified transfers, including a sector, geographic area, recipient, data type, exporter or transfer method.

If approval regulations cover the transfer, Article 44A does not require an Article 46 safeguard or Article 49 derogation for that transfer. The exporter and recipient still have to meet all other applicable UK GDPR duties, including lawful processing, transparency, security, processor terms, and accountability.

Confirm that personal data is being transferred to a third country or international organisation; remote access or onward disclosure can matter even when storage remains in the UK.
Identify the approval regulations in force, not only a policy announcement or adequacy assessment.
Match the country or organisation, recipient class, sector, geographic area, data type, exporter, and transfer method to any limits in the regulations.
Keep the regulations, official published-list check, scope analysis, destination and recipient, date checked, owner, and review trigger.
If approval does not cover the transfer, assess Article 46 safeguards or a fact-specific Article 49 derogation and check any Article 49A restriction.

Sources for this answer

Consolidated UK GDPR Articles 44A-45C

Binding current source for the transfer route, approval regulations, data protection test, scope limits, monitoring, amendment, revocation, and published lists.

UK data Adequacy assessment guidance

UK government guidance for Adequacy assessments and international data transfer context.

The UK approach to international data transfers

UK government policy and process guidance on transfer approvals and the wider international-transfer toolkit. The current consolidated Articles 44A-45C control where older terminology differs.

Section 2

Who should own an adequacy decision, and what evidence should prove the decision?

The exporter remains responsible for choosing and documenting the route. Privacy or legal should verify the regulations and their current scope; the business owner should identify the recipient, destination, purpose and onward-transfer path; procurement should confirm the contracting entity; and security should confirm the actual access and hosting arrangement.

Evidence should identify the transfer, exporter, importer, destination, approval regulations, effective status, every applicable scope condition, date checked, reviewer and change trigger. Keep a copy or stable link to the regulations and the Article 45C published-list result, not only a vendor statement that the destination is 'adequate.'

Identify the legal recipient, because approval for one scheme, sector or certified organisation does not automatically cover another recipient in the same country.
Record whether the transfer includes special-category or criminal-offence data and whether the approval regulations impose a data-type limit.
Record remote access, support access, subprocessors and onward transfers rather than checking only the primary storage country.
Recheck before a new recipient, country, sector, data type, transfer method or onward transfer is added, and when the approval regulations or Article 45C list changes.

Sources for this answer

Consolidated UK GDPR Articles 44A-45C

Binding source for the approval route and the scope and status facts an exporter must verify.

International data transfers

EU transfer guidance supplied as comparative background only; it does not establish the current UK Article 44A route.

The UK approach to international data transfers

UK government policy background on the wider international-transfer toolkit; current Articles 44A-49A and the applicable regulations control the route.

UK-US data bridge: explainer

UK government explanation of the UK-US data bridge, including its limitation to certified US organisations participating in the UK Extension.

Section 3

What should teams check before relying on an adequacy decision?

Before using this route, confirm that the approval regulations are in force, that the destination appears on the current list published under Article 45C, and that the transfer matches every scope limit. Article 45C requires ongoing government monitoring and amendment or revocation where the data protection test is no longer met.

If the destination is only partly covered, or if the approval has been amended or revoked, the uncovered transfer needs another Article 44A route before it proceeds. A government review alone does not change the legal route unless the regulations or their status change, but it is a reason to monitor the record closely.

Check whether the approval is country-wide, sector-specific, territory-specific, recipient-specific, data-specific, exporter-specific, scheme-based, or limited by transfer method.
For example, the UK-US data bridge described by the government covers transfers to US organisations participating in the UK Extension to the Data Privacy Framework; a US location alone is not enough.
Separate approval regulations from Article 46 safeguards such as the IDTA, UK Addendum, binding corporate rules, approved codes, or certification, and from Article 49 derogations.
Do not rely on an older approval if the destination, scope, or review status has changed.
Do not treat a data bridge as reciprocal: approval for UK exports says nothing by itself about transfers into the UK or exports from another jurisdiction.
Do not use a narrow Article 49 derogation as the default route for regular transfers; document its specific conditions and any Article 49A restriction.

Sources for this answer

Consolidated UK GDPR Articles 44A-49A

Binding current source for approval regulations, Article 46 safeguards, Article 49 derogations, Article 49A restrictions, and Article 45C monitoring.

UK data Adequacy assessment guidance

UK government guidance for Adequacy assessments and international data transfer context.

International data transfers

EU transfer guidance supplied as comparative background only; it does not establish a UK approval or its scope.

The UK approach to international data transfers

UK government policy background distinguishing approvals from other transfer tools; current statutory provisions control.

UK-US data bridge: explainer

Official example of a scheme-limited approval: the UK-US bridge applies to participating certified US organisations, not every US recipient.

Section 4

How should teams use adequacy in day-to-day transfer planning?

Use Article 44A as the route map: a transfer needs approval under Article 45A, appropriate safeguards under Article 46, or a specific Article 49 derogation, and it must not breach a restriction under Article 49A. Approval under Article 45A removes the need for an Article 46 safeguard for the covered transfer, but not the rest of UK GDPR.

Approve the route only after matching the real transfer to the regulations. If approval does not cover it, stop that branch and assess Article 46 safeguards or a fact-specific Article 49 derogation. Keep the transfer record linked to the Article 30 entry, contract, privacy information, security assessment and onward-transfer controls.

Input: exporter, importer, countries, access locations, personal-data categories, people, purpose, systems, transfer method, subprocessors and onward recipients.
Approval branch: cite the Article 45A regulations, match every scope condition, record the Article 45C list check, and retain the dated decision.
Safeguards branch: identify the Article 46 instrument and document the reasonable and proportionate data-protection-test assessment required by the current Article 46.
Derogation branch: identify the exact Article 49 condition, explain why it applies to this transfer, and check whether Article 49A restricts reliance on it.
Review branch: reopen the decision when the transfer facts, recipient participation or certification, regulations, published list, or onward-transfer chain changes.

Sources for this answer

Consolidated UK GDPR Article 44A

Binding route map requiring approval regulations, Article 46 safeguards, or an Article 49 derogation and compliance with any Article 49A restriction.

UK data Adequacy assessment guidance

UK government guidance for Adequacy assessments and international data transfer context.

International data transfers

EU operational background only; UK exporters must apply the current UK statutory route and approval regulations.

The UK approach to international data transfers

UK government policy background on alternative transfer tools when approval regulations do not cover the transfer.

Recommended next step