easily with foreign markets, while attracting investment from abroad by businesses that rightly have confidence in the responsible use of data within the UK. 3.2 Adequacy 234. Having left the European Union, the UK can capitalise on its independent status and repatriated powers in pursuit of the data opportunity. This includes having the freedom to strike our own international data partnerships with some of the world’s fastest growing economies, using our data adequacy capability. Explanatory box: What is a data adequacy capability? Under UK law, there are general restrictions on transferring personal data to other countries, in order to ensure that people’s data is sufficiently protected. Personal data can only be transferred to another country if that country provides an adequate level of protection, if there are appropriate safeguards in place to protect the personal data, or if one of a limited number of exceptions applies. UK law allows the government to assess whether other countries’ laws and practices provide an ‘adequate’ level of personal data protection. Where this assessment finds that a country does provide an adequate level of personal data protection, data adequacy status is granted to that country. Data adequacy findings are given effect through adequacy regulations made by the government. The effect of adequacy regulations is that personal data can be sent from the UK to the adequate country without any requirement for further safeguards. In practice, this means that a UK-based organisation can send personal data to an organisation based in the adequate country without needing to put in place additional measures (such as standard contractual clauses) to ensure that the data is protected. Adequacy regulations made by the government provide greater certainty and confidence in other countries’ data protection regimes.
235. The government is committed to the reduction of barriers and burdens that organisations face when transferring personal data freely and safely overseas. When assessing the data protection standards in other countries for adequacy, its ambition is to take a creative, collaborative and pragmatic approach and ensure high standards of data protection. 236. Under UK law there are two types of adequacy regulations: one which covers general data processing under the UK GDPR and Part 2 of the Data Protection Act 2018 and one which covers law enforcement data processing under Part 3 of the Data Protection Act 2018. The approach discussed in this section applies to both types of adequacy regulations. 237. Currently UK law treats as adequate for general data processing purposes the European Union and EEA states, the European Union institutions, the 12 countries the European Union had already assessed as adequate prior to European Union exit, and Gibraltar. For law enforcement data processing purposes, UK law treats as adequate the European Union and EEA states, Switzerland and Gibraltar. The government intends to add more countries to the list by progressing an ambitious programme of adequacy assessments in line with the UK’s global ambitions and commitment to high standards of data protection. Doing so will 87
