Harper James advises UK businesses on international data transfers under the UK GDPR and the laws of England and Wales. A transfer occurs when personal data is sent, accessed or made available to an organisation in a country outside the United Kingdom, including through cloud providers, overseas group companies and international support teams.
The international transfer rules apply where UK personal data is transferred to, or made accessible from, a country that does not benefit from UK adequacy regulations. The rules cover direct transfers, remote access and onward transfers by suppliers. Businesses should map the personal data involved, the destination country, the recipient, the purpose of processing and any further recipients before selecting a transfer mechanism.
A transfer is permitted where the destination has UK adequacy status, subject to the scope of that decision. Otherwise, the usual mechanisms are the International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or appropriate safeguards such as approved binding corporate rules. The selected document must reflect the parties, processing activities, data categories and onward transfer arrangements. A separate UK transfer risk assessment is generally required for restricted transfers using contractual safeguards.
A transfer risk assessment considers the legal framework and practices in the destination country, the likelihood of public authority access, the nature and sensitivity of the data, and the protections available in practice. The assessment should identify supplementary measures where necessary, such as encryption with UK-controlled keys, pseudonymisation, access restrictions, short retention periods and documented procedures for handling government access requests. The organisation must record its reasoning and review the assessment when the processing, supplier or relevant legal conditions change.
A business should maintain a register of international transfers and include appropriate transfer terms in supplier and intra-group agreements. Its privacy notices, data protection impact assessments, retention rules and security policies should describe the relevant processing accurately. Procurement and information security teams should check whether suppliers use sub-processors in other countries and whether those suppliers impose onward transfer requirements. Contractual safeguards do not remove the need for a lawful basis, transparency, security controls and data subject rights under the UK GDPR. Where no adequacy decision or safeguard applies, a limited derogation, such as explicit consent or necessity for a contract, is available only in specific circumstances and is not a substitute for an established transfer framework.