ICO updates international transfers guidance for law enforcement

The Information Commission (ICO) has issued updated guidance on international data transfers for law enforcement to reflect statutory reforms under the Data (Use and Access) Act 2025 (DUAA). The revised guidance offers clearer navigation and standardised terminology, helping public authorities evaluate cross-border transfer requirements. 

It clarifies that restricted data transfers made to and by data processors under Part 3 of the Data Protection Act 2018 (DPA18) are permitted. In addition, the DUAA introduces a statutory transfer risk assessment (TRA) test for when competent authorities rely on appropriate safeguards under Section 75. To support compliance, the ICO has introduced a dedicated Part 3 TRA approach, template, and checklist.

The guidance also highlights that UK competent authorities remain legally responsible for all restricted transfers of personal information conducted outside the country for law enforcement purposes, including transfers carried out by their appointed processors and sub-processors. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.