What is a restricted transfer, and what do you need to make one?

What it is

Since 2026-02-05 the safeguards route turns on the data protection test: whether, after the safeguards, the standard of protection for people would not be materially lower than in the UK. Transfers within the same legal entity, such as to its own overseas staff, are not restricted transfers.

When rules apply, and the routes

• Personal data is sent or made accessible to a receiver located outside the UK that is a separate controller or processor. UK GDPR Art 44
• Route 1: the destination is covered by UK adequacy regulations. Art 45
• Route 2: an appropriate safeguard, such as the IDTA, the UK Addendum to the EU clauses or binding corporate rules, meeting the data protection test. Arts 46 and 47; DUAA s.85
• Route 3: an exception, such as explicit consent or a contract with the person, used only occasionally. Art 49

What is not a restricted transfer

• Sending data within the same legal entity.
• Data merely routed through another country on its way to a UK recipient.

Who is responsible

The exporting controller or processor.

What it involves

1. Identify the transfer and the receiver.
2. Check adequacy.
3. If none, choose a safeguard and assess the data protection test.
4. Document the assessment.
5. Use an exception only where the others are unavailable.

If it goes wrong

Regulatory

Unlawful transfers breach Arts 44 to 49. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. The regulator can order transfers to stop.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.