UK GDPR Adequacy Regulations

First apply the ICO's restricted-transfer test: UK GDPR applies to the processing, your organisation initiates a transfer to an organisation outside the UK, and the recipient is a separate legal entity. If all three conditions are met, check the current ICO adequacy list and the underlying regulation.

Match the destination, territory, sector, recipient, data type, and any eligibility conditions. Record the regulation and date checked. If adequacy covers the transfer, no Article 46 safeguard or TRA is required, but the lawful basis, transparency, security, processor, rights, minimisation, and accountability duties still apply.

The ICO's current list includes full adequacy for the EEA countries and institutions, Andorra, Argentina, Faroe Islands, Gibraltar, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay, and the Republic of Korea. Canada and Japan have partial coverage under the conditions stated by the ICO. The United States has partial coverage only for eligible transfers under the UK Extension.

Treat this list as time-sensitive. The Secretary of State must monitor relevant developments and amend or revoke approval regulations if the Article 45B data protection test is no longer met. Check the ICO list and regulation when approving a new transfer and on a suitable review trigger.

Use an Article 46 safeguard and complete the data protection test, which the ICO continues to call a transfer risk assessment, or rely on a specific Article 49 exception if its conditions are met. Exceptions are not a substitute for routine safeguards simply because they are easier to document.

If part of a transfer is covered and part is not, separate the data or recipients and document the lawful route for each part. Stop the uncovered transfer if no safeguard or exception can lawfully support it.