Data Governance Atlas UK edition

International transfer route finder

Decision tool Data protection

Find the route for sending personal data out of the UK: adequacy regulations, a UK safeguard, or a derogation.

    Is personal data going to a separate organisation outside the UK?

    Yes No, it stays in the UK or within the same legal entity abroad

    Probably not a restricted transfer

    Chapter V applies to transfers to a separate receiver outside the UK. Your own staff accessing data abroad is not a restricted transfer, but security still applies.

    Basis: UK GDPR Chapter V; Art 32

    UK GDPR profile

    Is the destination covered by UK adequacy regulations? Check the adequacy lookup.

    Yes, and the receiver is within the scope covered No, or not sure

    UK adequacy regulations

    No further safeguard is needed for a transfer within the scope of the regulations. Record it in the record of processing.

    Basis: UK GDPR Art 45

    UK GDPR profile

    Is the receiver in your corporate group, with UK binding corporate rules approved?

    Yes No

    UK BCRs

    Transfer under the approved rules, with the data protection test assessed.

    Basis: UK GDPR Art 47

    Making a restricted international transfer procedure Restricted transfer check checklist

    Can you sign the IDTA, or the EU SCCs with the UK Addendum, and does the data protection test pass?

    Yes No

    IDTA or UK Addendum

    Use the IDTA, or the UK Addendum if the EU clauses are already in use, with a recorded assessment that protection is not materially lower than in the UK.

    Basis: UK GDPR Art 46; DPA 2018 s.119A

    Making a restricted international transfer procedure Restricted transfer check checklist

    Is this an occasional, specific transfer that fits an Art 49 derogation (explicit consent, contract necessity, important public interest, legal claims, vital interests)?

    Yes No

    Art 49 derogation

    Use it only for occasional, specific transfers and record why no other route was possible.

    Basis: UK GDPR Art 49

    UK GDPR profile Making a restricted international transfer procedure

    Do not transfer

    No lawful route. Transferring anyway is a regulatory infringement in the higher penalty tier, not a criminal offence, but it is among the most heavily penalised failures.

    Basis: UK GDPR Art 44; DPA 2018 s.155

    DPA 2018 profile Making a restricted international transfer procedure

    Sources