From adequacy to TRAs: Decoding the ICO’s latest international transfers guidance

Chapter V of the UK GDPR imposes a general prohibition on transfers of personal data from organisations in the UK to recipients located outside of the UK, unless the jurisdiction in which the data recipient is located benefits from an 'adequacy regulation', appropriate transfer mechanisms are implemented, or a derogation applies. To assist organisations with identifying when international transfers of personal data occur, and to help with understanding, navigating, and complying with the relevant rules, the UK Information Commissioner's Office ('the ICO') has published a detailed suite of new and updated guidance (the 'Guidance').

At a high-level, the Guidance provides information and direction to organisations on a range of topics, including:

• when the rules on transferring personal data to other countries apply, and who is responsible for complying with the rules;
• how to make a 'restricted transfer' of personal data;
• making transfers on the basis of 'adequacy regulations';
• transfer risk assessments ('TRAs'), including when organisations must complete TRAs; and
• relying on 'derogations' to transfer personal data internationally.

The ICO has said that it will continue to update the Guidance, including with respect to TRAs, the UK international data transfer agreement (‘IDTA’) and cloud services, and plans to add an interactive tool to assist organisations in determining whether they are making a restricted transfer, as well as provide further examples and case studies that reflect the complexity of global transfer scenarios.

This article summarises the key areas of the Guidance that are likely to impact organsiations. For organisations that are already closely familiar with Chapter V of the UK GDPR, the Guidance contains no major surprises, but is helpful for refreshing and clarifying the existing position.

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.