UK Adequacy Regulations

 UK Adequacy Regulations

By virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, Schedule 2, which inserted a new Schedule 21 into the Data Protection Act 2018, the following countries and institutions were identified at Part 3 paragraph 5 as being the subject of adequacy regulations by the UK for ex-UK restricted international data transfers:

an EEA state;

Gibraltar;

a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;

an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;

Switzerland;

Canada (in so far as the recipient is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA));

Argentina;

Guernsey;

Isle of Man;

Jersey;

Andorra;

Israel;

Uruguay;

New Zealand; and,

Japan (in so far as the data is subject to the Act on the Protection of Personal Information).

On 21 November 2022, the Secretary of State made The Data Protection (Adequacy) (Republic of Korea) Regulations 2022 (SI 2022/1213), which take effect from 19 December 2022, and which render transfers to individuals/entities subject to the Personal Information Protection Act in the Republic of Korea adequate.

On 21 September 2023, the Secretary of State made The Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028), which take effect from 12 October 2023, and which render transfers to individuals/entities self-certified to the Trans-Atlantic EU-US Data Privacy Framework and its UK extension adequate.