International Data Transfer Safeguards

Legal framework

International data transfers involve sending, making available or permitting access to personal data outside the United Kingdom. The UK GDPR restricts transfers to countries or international organisations that do not benefit from UK adequacy regulations. The rules apply to direct transfers, cloud hosting arrangements and some forms of remote access by overseas suppliers.

Harper James advises businesses on data protection and Data Protection Officer support under the laws of England and Wales. Organisations remain responsible for identifying restricted transfers, selecting a lawful transfer mechanism and demonstrating that their arrangements protect individuals’ rights.

Main safeguards

The principal safeguards are:

• Adequacy regulations: The UK has recognised certain countries and territories as providing an adequate level of protection. Transfers to those destinations can take place without additional transfer safeguards, although the organisation must still comply with the rest of the UK GDPR.
• International Data Transfer Agreement: The IDTA is a UK-approved contractual mechanism for restricted transfers.
• UK Addendum: The UK Addendum to the European Commission’s standard contractual clauses can be used where the EU clauses form part of the contractual arrangements.
• Binding corporate rules: Multinational groups can use binding corporate rules where the rules have received the required regulatory approval.
• Specific derogations: Limited exceptions include explicit consent, contractual necessity and certain public-interest grounds. These are not intended for routine, repeated transfers.

Transfer risk assessment

Before relying on contractual safeguards, an organisation should assess the legal framework and practices in the destination country. The assessment normally considers the nature of the data, the purpose and frequency of the transfer, the likelihood of public-authority access, the rights available to individuals and the importer’s technical and organisational controls.

Where the assessment identifies risks, supplementary measures may include encryption with the importer unable to access the key, pseudonymisation, strict access controls, data minimisation and contractual obligations concerning government-access requests. The measures must be effective for the particular transfer rather than adopted as a standard formality.

Practical governance

A business can manage transfers by maintaining a data map, recording suppliers and destinations, documenting the transfer mechanism, completing the relevant assessment, and reviewing the arrangement when the service, data or legal environment changes. Contracts should also address security, onward transfers, sub-processors, deletion or return of data, audit information and assistance with individual rights.

The transfer mechanism does not replace other UK GDPR duties. Organisations must still establish a lawful basis for processing, provide appropriate privacy information, apply security controls and carry out a Data Protection Impact Assessment where the processing is likely to create a high risk to individuals.