Passing of the first UK adequacy regulation : Personal data transfers from UK to South Korea simplified
SHARE
Passing of the first UK adequacy regulation : Personal data transfers from UK to South Korea simplified
On 19 December 2022, the UK’s first adequacy regulation came into effect. The adequacy regulation simplifies the transfer of personal data from the UK to South Korea.
What is an adequacy regulation?
An adequacy regulation is the UK Government’s determination that a country outside of the UK protects personal data to a similarly high standard as under UK law. Adequacy regulations are a key tool to promoting the flow of personal data internationally.
Prior to Brexit, adequacy decisions (the EU law equivalent) were determined by the European Commission (“EC”). The South Korean adequacy regulation is the first regulation made by the UK Government under UK GDPR; i.e. following Brexit.
What is the impact of the adequacy regulation?
In practical terms, UK-based organisations may now transfer personal data to South Korea without needing to put in place additional legal safeguards (such as an International Data Transfer Agreement). A full list of countries which are subject to UK adequacy regulations can be found on the ICO’s website.
However, due diligence should still be carried out before making an international transfer of personal data. In particular, if the data exporter is a data controller and the data importer a data processor then it will still be necessary to have in place a written Data Processing Agreement, or for equivalent data processing clauses to be incorporated into the parties’ written commercial contract. The ICO advises that controller-to-controller transfers should be subject to a formal Data Sharing Agreement. Without one, it may be difficult for the exporting organisation to demonstrate that the transfer complies with the UK GDPR data protection principles.
What’s next?
Although South Korea is not currently a popular destination for the transfer of personal data amongst our clients, South Korean service providers may become a more attractive outsourcing option now that the regulatory burden has been lightened. It is notable that the UK adequacy regulation covers the processing of personal credit information (which isn’t permitted by the EU’s own adequacy decision for South Korea). The UK government expects this decision to boost credit, lending, investment and insurance operations by UK businesses operating in South Korea.
The South Korean adequacy regulation is expected to be the first of many adequacy regulations. The UK government has announced several more territories that it is prioritising data adequacy regulations with, including the United States, Australia, Singapore, Dubai International Finance Centre and Colombia. Next in the government’s priority order are India, Brazil, Kenya and Indonesia. These proposals have been made with an aim to make the UK a global leader in ‘innovation-focused digital regulation’, so watch this space.
Please visit the Data Protection & GDPR area of our website for more information on the services we can provide in this regard.
For practical advice on how to ensure your international transfers of personal data comply with the law, please speak to Ryan Mitchell at Ryan.Mitchell@parissmith.co.uk or on 02380 482316.