GovWire

The RPC welcomes the voluntary submission of this umbrella IA for independent scrutiny; it is green-rated, fit for purpose. The proposal is to assess the standards of protection for personal data for third countries in order to grant adequacy status or not to facilitate the transfer of personal data from the UK. The IA provides the framework and methodology to assess the impacts in future IAs, which will be required for individual countries, if and when they are deemed adequate. Sections 17A and 74A of the Data Protection Act 2018 allow the UK to assess countries or jurisdictions data protection for the purpose of making data adequacy regulations for those countries. Data adequacy is a status granted by the UK to countries or jurisdictions that provide high standards of protection for personal data. When a country is found adequate, UK-based organisations can transfer personal data to that country without restrictions or safeguards.

The RPC notes that this IA caveats the analysis, noting data limitations. However, the RPC advises the Department to continually review how it can best improve the evidence base to support the cost-benefit analysis.

The Department has agreed to submit a number IAs for individual countries for scrutiny, as appropriate. Therefore this IA and opinion should be read in conjunction with the country specific IAs.