A restricted transfer out of the UK needs a route: UK adequacy regulationsAdequacy regulationsRegulations by the Secretary of State allowing transfers to a country without further safeguards, often called data bridges. Since the DUAA the test is whether protection there is not materially lower than in the UK., an Article 46 safeguard such as the IDTAIDTAThe International Data Transfer Agreement: the UK's own contract for restricted transfers where no adequacy regulations apply. or the UK AddendumUK AddendumAn addendum that adapts the EU standard contractual clauses for UK transfers, so a group can use one set of clauses for both., or exceptionally an Article 49 derogation. For the Article 46 route, the safeguard alone is not enough. You must also be satisfied that the transfer meets the data protection test.
The data protection test
From 2026-02-05, as amended by the DUAA 2025, a transfer under an Article 46 safeguard is permitted only if the standard of protection for the data subject after the transfer would not be materially lower than the standard under UK law. The controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. must act reasonably and proportionately in deciding that.
“Not materially lower” is deliberately not “essentially equivalent”, the EU test. It asks about outcomes for the person, not a line-by-line match of the foreign legal system.
What to look at
| Factor | The question |
|---|---|
| The data | How sensitive is it, and how much is there? |
| The importer | Who are they, and what will they do with it? |
| Destination law | Can public authorities access it, and are there limits and remedies? |
| Practice | What happens in reality, as well as on paper? |
| Safeguards | Encryption, pseudonymisationPseudonymisationReplacing identifiers so data cannot be attributed to a person without separately held information. Pseudonymised data is still personal data, unlike truly anonymous data., contractual commitments, transparency reports |
| Onward transfers | Where can it go next, and on what terms? |
Proportionality
The effort should match the risk. A routine transfer of business contact details to a supplier in a country with strong rule of law needs a short, recorded assessment. Large volumes of special category dataSpecial category dataHealth, genetic and biometric data, racial or ethnic origin, political opinions, beliefs, trade union membership, sex life and sexual orientation. Processing needs an Art 9 condition as well as a lawful basis. to a destination with broad state access powers need a detailed one, and may need supplementary measures, or no transfer at all.
Documenting it
Record the transfer, the route, the assessment and its conclusion, and review it when the law in the destination changes or the processing does. The regulator’s transfer risk assessment tool and guidance are designed for this, and are being updated for the DUAA.
When the test fails
Add supplementary measures and reassess. If no measure brings protection to a level that is not materially lower, the transfer cannot proceed on that route. An Article 49 derogation is for occasional, specific transfers only, not a fallback for a failed assessment.
Adequacy first
Check the adequacy list before doing any of this. Transfers within the scope of UK adequacy regulations need no safeguard and no data protection testData protection testThe DUAA test for international transfers: whether protection in the destination is not materially lower than in the UK. A different wording from the EU's essentially equivalent standard..