The ICO has amended its guidance on Transfer Risk Assessments to acknowledge that it is reasonable and proportionate to rely on a UK Government published adequacy assessment in support of transfers to the same jurisdiction under Article 46 GDPR (transfers subject to appropriate safeguards) (Article 46 Transfer) where the adequacy assessment covers third country protections for people in the UK, which apply to information received under an Article 46 Transfer mechanism.
The guidance states that currently the only such assessment relates to UK-US transfers. If you are relying on an Article 46 Transfer to the US (i.e. a transfer outside of the UK Extension to the EU-US Data Privacy Framework), you can rely on the Department for Science, Innovation and Technology’s analysis of the UK Extension to the EU-US Data Privacy Framework for the purpose of your Transfer Risk Assessment. The ICO advises that in preparing such a Transfer Risk Assessment, organisations should refer to the detailed ICO guidance on completing a Transfer Risk Assessment for transfers to the US.
The full guidance can be found here.
