Making a restricted international transfer
How to send personal data out of the UK lawfully: decide whether the transfer is restricted, find the route (adequacy regulations, an Art 46 safeguard with the data protection test, or an Art 49 derogation), and record it.
- Applies to
- Controllers and processors transferring personal data to a separate receiver outside the UK.
- Instruments
- UK GDPR, DPA 2018
- Steps
- 7 steps.
Mechanics
| Item | Position |
|---|---|
| Test | Data protection test: protection not materially lower than in the UK (from 2026-02-05) |
| First choice | UK adequacy regulations |
| Then | IDTA, UK Addendum or UK BCRs, with the test assessed |
| Last resort | Art 49 derogations, occasional and specific only |
Steps
-
Map the transfer
Identify what data goes where, to whom, why and how often, including remote access and onward transfers.
See UK GDPR
-
Decide whether it is restricted
A restricted transfer is to a receiver outside the UK that is a separate controller or processor. Your own staff accessing data abroad is not one, though security still applies.
See UK GDPR
-
Check UK adequacy regulations
If the destination, and the receiver within it, is covered, no further safeguard is needed. Use the adequacy lookup and check the regulations.
See UK GDPR
-
Otherwise choose an Art 46 safeguard
Use the IDTA, or the UK Addendum where the EU SCCs are already in use, or UK BCRs within a group.
See UK GDPR
-
Assess the data protection test
Assess whether protection after the transfer will not be materially lower than in the UK, considering the law and practice in the destination and the safeguards. Add supplementary measures if needed, and record the assessment.
See UK GDPR
-
Use a derogation only exceptionally
Where no other route works and the transfer is occasional and specific, check an Art 49 derogation such as explicit consent or legal claims.
See UK GDPR
-
Record and review
Record the transfer and its route in the record of processing, and review it when the law or the receiver changes.
See UK GDPR
A transfer without a valid route is an infringement in the higher penalty tier, up to the higher of £17.5m or 4% of turnover.
Checklists and tools for this procedure
International transfer route finder
Find the route for sending personal data out of the UK: adequacy regulations, a UK safeguard, or a derogation.
Restricted transfer check
Work through a transfer of personal data out of the UK: is it restricted, which route applies, and is the data protection test met and recorded?
Records of processing (Art 30)
Check a record of processing activities holds every field Art 30(1) requires of a controller.
Explainers
Sources
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) legislation.gov.uk
- Primary Data Protection Act 2018 (c. 12) legislation.gov.uk