ICO Updates Guidance on International Data Transfers (UK GDPR & DUAA 2025)
On the 15th January 2026, the ICO published its updated guidance on international transfers. This updated guidance is due to the Chapter V UK GDPR amendments, as a result of the Data (Use and Access) Act 2025 (“DUAA”).
What has changed in the ICO’s international transfer guidance?
The guidance is not a reinvention. It still explains what constitutes a restricted transfer, when the rules on international transfers apply and how to transfer data lawfully, but it’s much easier to navigate and there are clearer signposts and examples along the way.
How the new guidance is structured
A brief guide – This section is ideal for understanding international transfers at an overview level as it has some useful checklists.
Detailed guidance – This section is broken down into 6 key sections setting out the main considerations for determining if an international transfer is being made, and what is needed to comply. Again, checklists are provided.
Resources – This section includes a glossary of terms and quick reference FAQs.
The revised three-step test for restricted transfers
The most noteworthy change is the revised “three step test”. These three questions are designed to help you easily identify if you are making a restricted transfer.
- Step 1: Does the UK GDPR apply to our processing of the personal information we’re transferring?
- Step 2: Are we initiating the transfer of personal information to an organisation located outside the UK?
- Step 3: Is the organisation receiving the personal information a separate legal entity to us?
Answer “yes” to all three, and the international transfer rules apply. This is not a new concept but structuring these questions near the beginning of both the brief guidance and the detailed guidance aids clarity.
More focus on who is responsible for complying with the transfer rules
Controller vs processor responsibilities
The roles of controller and processor, in the context of who is initiating the transfer, is expanded upon within the guidance, which helps to clarify which party is responsible for complying with the transfer rules.
Why the Initiator of the transfer matters
The ICO confirms that the party who initiates the transfer must take responsibility for compliance and that may be the controller OR the processor, but not both. Useful examples are provided, which will be particularly helpful for organisations dealing with complex data flows and multiple processors and sub processors.
The guidance also explains the importance of the differences between the geographical location of the personal information and the contractual location of the parties. The ICO states,
“When we talk about transferring outside the UK, we’re talking about where the receiving organisation is based. This means where that organisation is established, not the actual geographical location of the information itself.
For a company or registered partnership, the relevant place of establishment is the country in which it is registered.
However, if it’s a registered overseas branch of a company, the relevant country is the location of that registered branch.”
This means that, if you are an organisation based in the UK and you contract with another organisation outside the UK to process personal data for you but this company uses a subsidiary in the UK to carry out the work, this would still be regarded as a restricted transfer, even though the personal information does not leave the UK. This is because the contract is with an organisation based outside the UK.
Therefore, an important factors in deciding whether or not the transfer rules apply, is the location of the contracting party, not the geographical location of the personal data.
Understanding adequacy under the new rules
The guidance on adequacy regulations (referred to as “transfers approved by regulation” in the legislation), explains that adequacy status will be granted to those countries which the UK government has assessed as having a level of data protection that is “not materially lower” than the UK.
This is a different test to that used before the DUAA was enacted, as previously the UK government had to ensure that the receiving country had a level of data protection that was “sufficiently similar” to the UK.
The guidance also provides clarity on how the UK extension to the EU-US Data Privacy Framework, the UK-US Data Bridge, interacts with UK adequacy regulations.
Transfer Risk Assessments (TRAs) and the new data protection test
What has changed in practice?
The requirement to complete a TRA hasn’t changed but the DUAA changes the terminology to a “data protection test”. This test is the same as that referred to above in relation to adequacy regulations. In particular, the exporter is no longer required to assess whether the receiving country’s data protection is “sufficiently similar” but must ensure that it is “not materially lower”.
This means organisations will now assess whether the protections in a receiving country are meaningfully equivalent to UK protections in real-world terms.
A more proportionate, risk-based approach
The new guidance doesn’t deregulate the need for a TRA but moves towards a more proportionate and risk based judgement, taking into account the specific circumstances of the transfer, the type and quantity of data and the type of recipient and destination country.
In particular, the exporter can take into account what is reasonable and proportionate, bearing in mind the nature and volume of the data involved.
For continuity the ICO guidance still uses the more familiar term of TRA.
Key takeaways from the updated ICO guidance
The most fundamental change explained in the revised guidance is that the test for assessing the receiving country’s level of data protection has changed from ensuring that it “sufficiently similar” to “not materially lower”. The remainder of the guidance brings greater clarity with more contextual, real world examples to assist with the assessment process.
Support for international transfers
If your organisation requires support and guidance for international transfers, our expert DPOs can help.
