The importance of data flows to modern commerce and society is well established, and in the UK this centrality is ­recognised by government and the regulator. But the growing importance of an interconnected digital economy has moved in tandem with growing ­concerns from organisations about the stability and certainty of data transfer mechanisms.

For the UK, the changes to the UK GDPR via the Data Use and Access Act 2025 (the DUAA) represents an opening to shift away from the EU GDPR approach to data transfers and strike its own path towards an outcomes-based approach. The necessity to do so is clear, with the government’s 2024 UK business data survey(1) identifying data transfers as essential to business function for businesses of all sizes, and in all sectors.