Transfer personal data outside the UK

If your business sends personal data outside the UK, you must ensure adequate protections are in place. This applies whether you're transferring customer data to a cloud provider, sharing employee information with an overseas office, or using third-party services hosted abroad.

UK GDPR Chapter V sets out the rules for restricted transfers: transfers of personal data to countries outside the UK that don't have equivalent data protection standards. You cannot simply send personal data anywhere in the world; you need a lawful mechanism to do so.

When these rules apply

You're making a restricted transfer if you send personal data to:

• A country outside the UK (and EEA) without an adequacy decision
• An international organisation
• A cloud service provider whose servers are located outside the UK
• A subsidiary, branch, or partner in another country

Transfers within the UK, and to the EEA (EU plus Iceland, Liechtenstein, Norway), are not restricted transfers.

Check if the destination has an adequacy decision

The easiest way to transfer personal data outside the UK is to a country with an adequacy decision. This is a formal recognition by the UK government that a country provides an equivalent level of data protection to the UK.

If a country has an adequacy decision, you can transfer personal data there without additional safeguards - it's treated like a transfer within the UK.

The US does not have a blanket adequacy decision. Only transfers to US organisations participating in the UK Extension to the EU-US Data Privacy Framework benefit from adequacy-like protections. On the official DPF list, verify that the recipient has specifically opted in to the UK Extension, not merely that it has general DPF certification.

Adequacy decisions can change, so check the list on the Information Commission (formerly the ICO) website before you decide how to transfer.

In the other direction, the European Commission renewed its adequacy decisions for the UK on 19 December 2025 for a further six years, so personal data can flow from the EU to the UK without additional safeguards.

Use appropriate safeguards if no adequacy decision

If transferring to a country without an adequacy decision, you must put one of these safeguards in place:

• Standard Contractual Clauses (SCCs), the most common mechanism for businesses
• the UK International Data Transfer Agreement (IDTA)
• the UK Addendum to the EU SCCs, if you already use EU SCCs
• Binding Corporate Rules (BCRs), approved internal policies for multinational groups, which are complex and expensive and usually only practical for large organisations
• an approved code of conduct, with enforceable commitments from the data importer
• an approved certification scheme that includes binding commitments

Standard Contractual Clauses (SCCs)

SCCs are the most widely used mechanism for international transfers. They are pre-approved contract terms that bind the data importer to protect personal data to UK standards, even if local law is weaker.

SCCs come in four modules:

• controller to controller (C2C), when you share data with another organisation that decides how to use it
• controller to processor (C2P), when you send data to a service provider that processes it on your behalf
• processor to processor (P2P), when a processor engages a sub-processor
• processor to controller (P2C), when a processor sends data to a controller, which is less common

You must select the appropriate module based on your relationship with the recipient.

UK International Data Transfer Agreement (IDTA)

The IDTA is the UK's own transfer mechanism, approved by the ICO in March 2022. It's designed specifically for UK GDPR and can be used as a standalone document.

Use the IDTA if:

• You're a UK-based organisation making transfers for the first time
• You want a single, simpler document instead of adapting EU SCCs
• You're setting up new vendor relationships

The IDTA has:

• Tables to complete with transfer details (parties, data types, safeguards)
• Mandatory clauses that cannot be amended
• Some optional clauses that can be tailored
• Clear allocation of responsibilities between exporter and importer

UK Addendum to EU SCCs

If you already have EU SCCs in place (for EU GDPR compliance), you can add the UK Addendum to extend their coverage to UK data transfers. This is often simpler than adopting a completely separate IDTA.

Use the Addendum if:

• You already have EU SCCs with a vendor
• You need to cover both EU and UK transfers to the same recipient
• Your vendor prefers to work with SCCs they're familiar with

The UK Addendum is a short document that references the EU SCCs and modifies them for UK law.

Conduct a Transfer Risk Assessment (TRA)

Even with SCCs or an IDTA in place, you must assess whether the safeguards will work in practice. This is called a Transfer Risk Assessment (sometimes called a Transfer Impact Assessment).

You must assess:

• The laws of the destination country - could local authorities access the data?
• Whether the contractual protections can be enforced in that country
• The specific circumstances of your transfer (sensitivity of data, volume, recipient)
• Whether supplementary measures are needed to plug any gaps

Supplementary measures

If your TRA identifies risks that SCCs/IDTA alone cannot address, you may need to implement supplementary measures:

Technical measures include end-to-end encryption where you control the keys, pseudonymisation and splitting processing across jurisdictions. Contractual measures include extra audit rights, transparency reporting and commitments to challenge government requests for access. Organisational measures include due diligence on the importer, staff training and governance policies.

If no combination of safeguards and supplementary measures can adequately protect the data, you should not make the transfer.

Exemptions (derogations)

In limited circumstances, you can transfer personal data without adequacy or safeguards. Use these exemptions sparingly. They do not allow regular, repeated transfers. You can rely on one if the transfer is:

• made with the individual's explicit consent, after they have been told the risks
• necessary to perform a contract with the individual, such as booking a hotel abroad, or to take steps they asked for before a contract
• necessary for a contract between you and someone else that is in the individual's interest, such as arranging travel for them
• necessary for important reasons of public interest recognised in UK law
• necessary to establish, exercise or defend legal claims
• necessary to protect someone's life when they cannot give consent
• made from a register intended to give information to the public

Using exemptions correctly

Explicit consent is often misunderstood. It requires:

• Clear, specific information about the destination country and risks
• An affirmative action from the individual (not pre-ticked boxes)
• The individual must have genuine choice - consent isn't valid if they have no alternative
• Easy withdrawal of consent at any time

A transfer for a contract must be genuinely necessary, not just convenient. You cannot rely on this exemption if you could perform the contract without the transfer (e.g., using a UK-based provider instead).

Exemptions are not a general solution. They are designed for occasional, specific transfers - not for routine business operations like using overseas cloud services or sending employee data to a foreign head office.

Whichever route you use, tell people in your privacy notice which countries you transfer their data to, what safeguards you use and how they can get copies of the transfer documents.

Penalties for unlawful transfers

Transferring personal data outside the UK without appropriate safeguards is a serious breach of UK GDPR. It falls under the higher tier of penalties. The Information Commission can also issue an enforcement notice requiring you to stop the transfer and bring your processing into compliance.