ICO Reveals New Transfer Risk Assessment Tool

The Information Commissioner's Office ("ICO") has revealed a revised guidance on international data transfers, including a new section on transfer risk assessments ("TRA") and a TRA tool.

The UK GDPR contains rules about transfers of personal data to importers located outside the UK, which are referred to as restricted transfers. One way to comply with the UK GDPR rules on restricted transfers is to implement an Article 46 transfer mechanism. These are the so-called appropriate safeguards and examples include the ICO's International Data Transfer Agreement ("IDTA"), the Addendum to the EU SCCs (the "Addendum") and Binding Corporate Rules ("UK BCRs").

The implementation of a TRA helps organisations ensure that, in specific circumstances of restricted transfers, the Article 46 transfer mechanism will provide adequate protections as well as effective and enforceable rights for people.