New UK guidance on Transfer Risk Assessments
On 17 November 2022, the UK’s Information Commissioner’s Office (ICO) published an update to its guidance on international transfers. This included specific guidance about transfer risk assessments or TRAs and a tool for undertaking TRAs.
The TRA Guidance and TRA Tool are relevant whenever an organisation that is subject to the UK GDPR transfers personal data to a non-adequate jurisdiction based on one of the transfer mechanisms in Article 46 of the UK GDPR (i.e. the ICO’s International Data Transfer Agreement, the EU Standard Contractual Clauses (together with the UK Addendum) or Binding Corporate Rules).
TRAs are essentially the UK’s equivalent of the “transfer impact assessments” required by the European Data Protection Board in the EU and set out in the EDPB guidance on accountability in data transfers and supplementary measures. The ICO is clear that their TRA Tool is just one approach to conducting the required assessments and that organisations located in the UK can still use the EDPB Approach should they wish to do so.
Source: New UK guidance on Transfer Risk Assessments | Data Protection Report
