ICO Updates UK GDPR International Transfer Guidance

ICO News & Blogs

Published January 15th, 2026

Detected February 11th, 2026

Summary

The UK's Information Commissioner's Office (ICO) has updated its guidance on international personal data transfers under UK GDPR. The revised guidance aims to simplify compliance for businesses by introducing a 'three step test' and clarifying complex areas.

View original document View source feed page

What changed

The ICO has published updated guidance on international data transfers under UK GDPR, designed to make compliance more accessible for businesses. Key changes include a streamlined 'three step test' to identify restricted transfers, new content addressing roles and responsibilities in multi-layered scenarios, and supplementary resources like FAQs and a glossary. This update is part of an ongoing project that will further refine guidance on transfer risk assessments (TRAs), the international data transfer agreement (IDTA), and cloud services, with plans for an interactive tool and more case studies.

Organisations involved in international data transfers should review the updated guidance to understand the new 'three step test' and enhanced clarity on roles and responsibilities. The ICO is also hosting a webinar to discuss the changes. While no specific compliance deadline is mentioned, prompt review is advised to ensure adherence to UK GDPR transfer requirements. The guidance is intended to support innovation while ensuring responsible data handling.

What to do next

Review updated ICO guidance on international data transfers under UK GDPR.
Familiarise with the new 'three step test' for identifying restricted transfers.
Attend the ICO webinar on the guidance changes.

Source document (simplified)

Updated guidance on international transfers published

Date 15 January 2026
Type News We have updated and enhanced our guidance on international transfers of personal information, making it quicker for businesses to understand and comply with the transfer rules under UK GDPR.

The updated guidance clearly sets out key requirements, reduces complexity and supports the responsible transfer of personal information – evidencing our commitment to supporting innovation and economic growth.

The streamlined guidance sets out a clear ‘three step test’ for organisations to use to identify if they’re making restricted transfers and we’ve added new content to help provide clarity on areas we know organisations have questions on. Additional new content has been added on roles and responsibilities, which reflects the complexity of multi-layered transfer scenarios. In addition, a brief guide, quick reference FAQs and a Glossary will support organisations which don’t have specialist knowledge or experience in making international transfers.

The update is part of an ongoing project which will further develop parts of our guidance, such as our approach to transfer risk assessments (TRAs), and additional guidance on the international data transfer agreement (IDTA) and cloud services. We also plan to add an interactive tool to help organisations identify whether they’re making a restricted transfer, and more examples and case studies that reflect the complexity of global transfer scenarios.

To further support organisations with their approach to international transfers, we are hosting a webinar to talk through the changes and highlight the main things organisations making or advising on restricted transfers need to know.