The United Kingdom is now independent when it comes to cross-border data transfer. Pre-Brexit, it was a part of the European Union. Now, the rules for data transfer are different. The UK has its own set of rules, called the UK GDPR. Even with these new rules, the UK and the EU have agreed that they can still transfer data to each other as before. This creates distinct compliance obligations depending on the direction and jurisdictions involved in data flows.
Current Status and Legal Framework Overview
Since January 31, 2020, the UK has been using its own data protection framework through the Data Protection Act 2018 and UK GDPR, while continuing to maintain close alignment with EU standards. In 2021, the EU decided that the UK's rules were good enough to let information flow easily between the two. This agreement was going to end in June 2025 but was recently extended to December 27, 2025.
The European Commission granted the UK adequacy decisions in June 2021, originally set to expire in June 2025 but recently extended to December 27, 2025, to allow assessment of the UK's new Data (Use and Access) Act 2025. This is so the EU can check out a new law the UK has, called the Data (Use and Access) Act 2025.
On July 22, 2025, the UK's adequacy status remains secure following the European Commission's draft decision, which confirms that UK data protection standards continue to be "essentially equivalent" to EU requirements, even with the implementation of the Data Use and Access Act, 2025. This provides continued certainty for data flows between the EU and UK.
a) UK to EU transfer
Legal Mechanism
Businesses in the EU can send private information to the UK without problems. This is because the EU has said the UK's rules for keeping data safe are good enough.
This agreement is good for most kinds of information, but there is one thing it does not cover: information used for checking who can enter the UK.
The current agreement is valid until the end of December 2025. After looking at the UK's new law (the DUAA), the EU has said it is a good idea to keep this agreement going for another six years.
Risks and Considerations for EU Businesses
Even though it is now easy to send information, EU businesses should watch a few things:
- The Agreement could end: The agreement could be stopped if the UK's rules for data start to become very different from the EU's rules.
- New Laws in the UK: The new UK law (DUAA) has some small changes for how people can make decisions with computers and how the main data office in the UK is set up. The EU has looked at this and said it is not a big problem.
- Immigration: If you need to send information for UK immigration checks, you will have to use other safety steps. The main agreement does not cover this.
b) EU to UK transfer
UK Recognition of EU Adequacy
The UK has said that the rules in all EU countries are good enough to keep private information safe. This means that information can be sent back and forth between the UK and the EU easily. This includes:
- All 27 EU countries
- Some other countries like Iceland and Norway
- EU offices and groups
- Gibraltar
Formalities and Requirements
Businesses in the UK that send information to the EU do not need to do much. Because the UK agrees the EU's rules are safe, they do not have to fill out any extra forms.
Even so, these businesses still have to follow the UK's own rules. For example, they must have a good reason to use someone's private information and be clear about how they will use it.
Alignment and Differences
The rules in the UK and the EU are still very much alike. But some small things are starting to be different:
- Keeping the Country Safe: The UK's rules let them use information in more ways for national safety, immigration, and spy groups.
- The Main Office: In the UK, there is only one main office that looks after data rules (the ICO). In the EU, each country has its own office, and they all work together.
- Fines: The biggest fine for breaking the rules is different. In the UK, it is about £17.5 million, while in the EU, it is about €20 million.
c) UK to Third Countries and Other Countries
UK Adequacy Determinations
The UK has decided that the rules for keeping data safe in some other places are good enough. This means that information can be sent to these countries easily:
- Europe: All countries in the European Union (EU) and a few others like Norway.
- Gibraltar: This place has its own agreement with the UK.
- Republic of Korea: The UK has said their rules are good enough.
- USA: The United Kingdom has a limited agreement with the US for sending data.
- Old EU Agreements: The United Kingdom also agrees with the same countries that the EU had agreements with before the UK left the EU.
Tools for Sending Information from the UK
When the UK wants to send information to a country that does not have good enough rules, businesses must use special tools. This helps keep the data safe:
- International Data Transfer Agreement (IDTA): This is a special paper the UK made just for sending data. It has clear rules that businesses must follow. They also need to check how safe the data will be in the new country.
- UK Addendum to EU SCCs: This is a way to use the EU's papers for sending data, but with some small changes for the UK. This is good for companies that work with both the EU and the UK.
- Binding Corporate Rules (BCRs): Big companies that have offices in many countries can use these. It is a set of their own rules for sending information inside the company.
d) Transfer Tools Under UK GDPR
If a company outside the UK gets information from a UK business, it must:
- Follow the rules in the papers like the IDTA. This includes keeping the data safe and telling the UK business if there is a problem.
- Work with the UK business to check how safe the data will be in their country.
- Let the UK business know if their local laws change.
- Make sure people from the UK can use their rights to see, change, or remove their private information.
e) Third-Country-to-EU Transfers
EU GDPR Obligations for Third Countries
Any country that gets private information from the EU must follow the EU's rules.
- Rules or Tools: Information can only be sent from the EU to countries that the EU has said are safe, or by using special papers like the Standard Contractual Clauses. The EU has agreements with 15 countries, including the US, the UK, and Japan.
Checking for Risks: After a court ruling, businesses must check to see if the laws in the receiving country might put the data at risk. This means they must:
- Look at what laws allow the government to get data.
- Decide if they need to add more safety steps.
- Write down their findings to show they did the check.
- Keeping People's Rights Safe: Companies that get data from the EU must make sure that people from the EU can use their rights to their data.
Multi-Jurisdictional Compliance Strategies
Companies that work in the UK, the EU, and other places should have a plan to follow all the rules:
- Unified Privacy Framework: Have a single plan for privacy that follows the highest safety rules from all the places you work in.
- Pick the Right Tools: Use the agreements that make it easy to send information to safe countries. For other countries, use the special papers (like the SCCs or IDTA).
- Risk Assessment: When you check for risks, use the same method for both the UK and the EU.
- Work Together: Have one team that looks after all the data rules and knows about the UK's office (ICO) and the EU's offices.
- Monitoring and Adoption: Since the rules are always changing, you should have a way to know about new laws in all the places you work.
The time after Brexit means companies have to be smart about how they handle data. They must make sure they are following the rules for the UK, the EU, and the rest of the world. It is important to find a good balance between doing business and staying safe while the rules keep changing.
