International transfers

Two directions, two regimes. Transfers out of the UK are governed by UK GDPR Chapter V, reframed by the DUAA 2025 around the data protection test from 2026-02-05. Transfers from the EU into the UK depend on the EU's adequacy decisions for the UK.

Out of the UK: the routes

A restricted transfer needs one of these. Adequacy regulations first; then an Art 46 safeguard with the data protection test behind it; then, exceptionally, an Art 49 derogation.

• UK adequacy regulations (data bridges)

  Regulations made by the Secretary of State under Art 45 allowing transfers to a country, territory, sector or international organisation without further safeguards

  Best for

  Transfers to destinations already covered, including the EEA and the countries the UK recognised at the end of the transition period

  Watch out for

  Since 2026-02-05 the test is the DUAA data protection test (protection not materially lower), not the EU's essentially equivalent standard. Coverage can be partial, so check the regulations for the destination and the sector.

  Basis

  UK GDPR Art 45, as amended by DUAA 2025 s.85 and Sch 7

• UK Extension to the EU-US Data Privacy Framework

  UK adequacy regulations covering transfers to US organisations certified to the Data Privacy Framework with the UK Extension

  Best for

  Transfers to a US recipient that is on the DPF list and has opted into the UK Extension

  Watch out for

  Only covers certified organisations, and depends on the underlying EU-US framework surviving challenge. Check the recipient's certification at the time of transfer.

  Basis

  UK GDPR Art 45; Data Protection (Adequacy) (United States of America) Regulations 2023

• International Data Transfer Agreement (IDTA)

  The UK's own standard contract for restricted transfers

  Best for

  Transfers to a destination without UK adequacy regulations, where the parties are not also using the EU clauses

  Watch out for

  A transfer risk assessment must sit alongside it, now framed by the data protection test. The regulator's international transfers guidance was updated for the data protection test on 2026-01-15.

  Basis

  UK GDPR Art 46; DPA 2018 s.119A

• UK Addendum to the EU standard contractual clauses

  An addendum that makes the EU SCCs work for UK restricted transfers

  Best for

  Groups and suppliers already using the EU SCCs who want one contract set for EU and UK transfers

  Watch out for

  Only works bolted onto the EU SCCs, and carries the same transfer risk assessment duty as the IDTA.

  Basis

  UK GDPR Art 46; DPA 2018 s.119A

• UK binding corporate rules

  Intra-group rules approved by the UK regulator for transfers within a corporate group

  Best for

  Multinational groups with frequent intra-group transfers

  Watch out for

  Slow and costly to obtain. EU BCRs do not automatically cover UK transfers: UK approval is separate.

  Basis

  UK GDPR Art 47

• Article 49 derogations

  Narrow exceptions allowing a transfer without adequacy or safeguards, such as explicit consent, contract necessity, important public interest or legal claims

  Best for

  Occasional, specific transfers that cannot reasonably use another route

  Watch out for

  Read restrictively. Not a basis for routine or systematic transfers, and consent must be explicit and informed of the risks.

  Basis

  UK GDPR Art 49

• Applying the data protection test

  The controller's own assessment, when using an Art 46 safeguard, that protection after the transfer will not be materially lower than in the UK

  Best for

  Every IDTA, Addendum or BCR transfer, as the assessment that sits behind the contract

  Watch out for

  Replaces the old transfer risk assessment framing. It is a reasonableness standard, not a requirement for identical law, but it must be done and recorded.

  Basis

  UK GDPR Chapter V, as amended by DUAA 2025 s.85 and Sch 7

Out of the UK: adequacy regulations

46 destinations are covered by UK adequacy regulations, 3 of them only in part. Search the adequacy lookup for a destination and the scope of its cover.

Into the UK: EU adequacy