The UK Government can assess whether another country, territory or an international organisation provides an adequate level of data protection compared to the UK. An adequacy assessment may cover either general processing, law enforcement processing, or both. The Government must consider a range of factors and ensure that sending personal data to that country, territory or international organisation does not undermine people’s protections.
Some countries may have a substantially similar level of data protection to the UK. In these cases, the Government can make UK adequacy regulations. This allows organisations to send personal data to that country, territory or international organisation if they wish.
We support the Government in undertaking adequacy assessments and making regulations to enable personal data to flow freely in our global digital economy to trusted partners. We do this by providing independent assurance on the process followed and the factors that government officials take into consideration. This allows the Secretary of State to make an informed and reasonable decision. By doing this work once for everyone, the Government and the ICO are reducing the burden of compliance on organisations that would otherwise have to put alternative measures in place.
You can read our Opinions on each adequacy assessment the Government has undertaken.
| Opinions on adequacy for general processing | Date published |
| The UK Government’s assessment of adequacy for the UK Extension to the EU-US Data Privacy Framework for the general processing of personal data | 21 September 2023 |
| The UK Government’s assessment of adequacy for the Republic of Korea for the general processing of personal data | 23 November 2022 |
| Opinions on adequacy for law enforcement processing | Date published |
| The UK Government’s assessment of adequacy for the Bailiwick of Jersey for the law enforcement processing of personal data | 22 November 2023 |
| The UK Government’s assessment of adequacy for the Bailiwick of Guernsey for the law enforcement processing of personal data | 07 July 2023 |