Skip to main content

Data flows

Brief guidance for information governance (IG) professionals about data flows to countries outside of the European Union (EU).

Page contents

Data is allowed to flow to these countries which are currently deemed ‘adequate' in relation to international data transfers. For other countries you would need to ensure appropriate safeguards are in place or rely on an exception. In all cases you must also complete a Transfer Risk Assessment. 

Data flows from the EU to the UK

The EU has formally recognised the UK's high data protection standards through an 'adequacy decision'. This means that data can continue to flow from the EU to the UK and there should be no interruption in the data received by health and care organisations from the EU. The adequacy decision is currently in place until December 2031. During this time it can be relied upon as a legal basis for transfers of personal data from the EU to the UK.

Data flows from the UK to the EU

Data is allowed to flow from the UK to the EU. This is because all countries in the European Economic Area (EEA) have full adequacy under UK adequacy regulations.

These IG pages provide clear and consistent IG advice and guidance to patients and service users, health and care staff and IG professionals. NHS England convenes a working group to check and challenge the guidance.

Last edited: 7 May 2026 4:25 pm