Fixing International Data Transfers
Almost every UK website sends personal data abroad without anyone deciding to. The email platform is American, the help desk stores tickets in Ireland, the developer who maintains the site works from another country, and the analytics provider moves data wherever it likes.
Each of those can be a restricted transfer under the UK GDPR, and each needs a recognised basis. This guide explains how to find your transfers, which basis fits each one, and what to record and tell people. It is general guidance, not legal advice.
What counts as a restricted transfer
Chapter V of the UK GDPR controls personal data leaving the UK. In broad terms, a restricted transfer happens when you send personal data, or make it accessible, to a receiver located outside the UK that is a separate organisation or person from you. The ICO's guidance sets out the test in more detail, and it is worth reading if your situation is unusual.
Some points catch people out:
- Access counts, not just sending. A contractor in another country who can log into your shop's admin panel and see customer orders is receiving personal data, even if nothing is downloaded.
- The supplier's sub-processors count too. A UK-based hosting company may still use a support team or backup location abroad. Its contract should cover those onward transfers.
- Your own staff are different. An employee of your company working temporarily abroad is not a separate receiver, so that is not normally a restricted transfer, although you still need to keep the data secure.
- Data in transit. Data that merely passes through another country on its way between two UK points is not a restricted transfer.
- The EU is outside the UK. Sending data to an Irish or German supplier is a transfer; it is simply covered by adequacy regulations, as explained below.
This guide is not legal advice. Transfers involving large volumes, special category data, or countries without adequacy regulations are areas where specialist advice is worth having.
The three routes that make a transfer lawful
A restricted transfer is lawful if one of these routes applies. Work through them in order, because the first is the simplest.
| Route | What it is | What you need to do |
|---|---|---|
| 1. Adequacy regulations ("data bridges") | The UK government has recognised the destination, or a framework within it, as providing adequate protection. | Confirm the destination or the receiving organisation is covered, record it, and tell people. |
| 2. Appropriate safeguards | A contract or other instrument that binds the receiver to protect the data, most often the IDTA or the UK Addendum to the EU standard contractual clauses. Binding corporate rules are used by some large groups. | Sign the safeguard, assess the risks in the destination, and add extra measures if needed. |
| 3. Exceptions | Limited cases such as the person's explicit informed consent, or a transfer necessary for a contract with them. | Use only for occasional, specific transfers, never as the routine basis for a supplier you use every day. |
What the Data (Use and Access) Act 2025 changes
The Data (Use and Access) Act 2025 revises the Chapter V framework. Instead of the old adequacy test, the government now considers whether protection in the destination is not materially lower than in the UK, described as the data protection test, and a similar standard applies when organisations rely on safeguards. Existing adequacy regulations, the IDTA and the Addendum continue to be used. The provisions are being brought into force in stages, so check the ICO's current guidance for the detail on how the new test applies to your assessments.
UK adequacy and the US data bridge
The UK recognises the countries of the European Economic Area, together with a number of other countries and territories. The list includes, among others, Switzerland, Japan, New Zealand, Canada for organisations covered by its federal private-sector law, Israel, Argentina, Uruguay, the Republic of Korea, Guernsey, Jersey and the Isle of Man. The list changes, so check the current position on GOV.UK or in the ICO's guidance rather than relying on any copied list, including this one.
The United States
The US is not covered as a whole. Instead, the UK Extension to the EU-US Data Privacy Framework, often called the UK-US data bridge, covers transfers to US organisations that have self-certified to the Data Privacy Framework and have also signed up to the UK Extension. That second condition matters: some companies are certified for EU data only.
- Search for the company on the official Data Privacy Framework website.
- Open its entry and check that its status is active and that the UK Extension is shown.
- Check that the certification covers the type of data you send. Some entries cover HR data only, or non-HR data only.
- Save a screenshot or PDF of the entry with the date, as part of your records.
If the supplier is not certified for the UK Extension, you need an appropriate safeguard instead, usually the IDTA or the Addendum, which many US suppliers already include in their data processing terms.
IDTA or Addendum: which to use
The ICO publishes two standard contracts for restricted transfers, both laid before Parliament in 2022:
- The International Data Transfer Agreement (IDTA). A standalone UK contract. Useful when the arrangement only involves UK data, or when you want one self-contained document.
- The International Data Transfer Addendum. A short document that attaches to the European Commission's standard contractual clauses and adapts them for UK transfers. Most useful when a supplier already uses the EU clauses for EU customers, because one set of contracts can then cover both.
In practice, you rarely draft either yourself. Large suppliers build them into their data processing agreement, and you accept them when you accept the terms. Your job is to find the clause, confirm it covers UK transfers, and keep a copy. Look for wording such as "UK Addendum", "International Data Transfer Addendum", "IDTA" or "UK transfer mechanism" in the supplier's data processing terms or privacy documentation.
The older EU clauses from before 2021 can no longer be relied on for new or existing UK transfers; the ICO's transitional arrangements for them have ended. If a supplier's paperwork still points only to those clauses, ask for updated terms.
For the wider contract every processor needs, whether or not data leaves the UK, see our guide to fixing missing processor contracts.
The fix, step by step
Step 1
List every supplier and person outside the UK
Start from your supplier invoices, website scripts and the list of people with admin access. For each hosting, email, analytics, payment, support, chat, backup and advertising service, find where it stores data and where its support teams sit, using its sub-processor list. Add freelancers, agencies and developers abroad who can see customer data. Record the company, the country, the data involved and whether it acts as your processor or as an independent controller.
Step 2
Decide which flows are restricted transfers
For each row, ask whether personal data is sent to, or made accessible by, a separate organisation or person located outside the UK. Mark those as restricted transfers. Remove rows where the supplier genuinely keeps and handles the data only in the UK, but keep a note of the sub-processor list you checked. Mark your own employees working abroad separately, since they are not normally a restricted transfer but still need secure access.
Step 3
Check for UK adequacy or the US data bridge
For destinations in the EEA or another country with UK adequacy regulations, note the regulation and move on. For US suppliers, search the official Data Privacy Framework list and check the entry is active, includes the UK Extension and covers the right type of data. Save the entry with the date. Anything left, whether a US supplier without the UK Extension or a country with no adequacy regulations, needs a safeguard in the next step.
Step 4
Put an IDTA or the Addendum in place where needed
Open each remaining supplier's data processing terms and look for the IDTA or the UK Addendum to the EU standard contractual clauses. If it is there, accept or sign it and file a copy. If it is missing, ask the supplier for it in writing. For freelancers and small partners abroad, complete the ICO's template yourself with their details. If a supplier cannot offer any safeguard, plan to move to one that can.
Step 5
Assess the risk and add extra protections
For transfers relying on the IDTA or Addendum, record an assessment of whether the data will be adequately protected in practice, considering the type of data, the destination's laws on public authority access and the supplier's security. The ICO provides a tool and guidance for this. Where risk is higher, add protections such as encryption with keys held in the UK, pseudonymisation, or sending less data, and note what you chose.
Step 6
Update the privacy policy and your records
In the privacy policy, add a section on transfers outside the UK that names the countries or regions involved and the safeguard for each, such as adequacy regulations, the UK Extension to the Data Privacy Framework or the IDTA, and says how people can get more information. Add the transfer details to your record of processing, set a yearly review reminder, and run the GDPR Audit again.
A worked example
Consider Larkspur Garden Supplies, a fictional online shop with a UK company, a UK hosting provider, an American email marketing platform, a help desk based in Ireland, and a freelance developer in South Africa who maintains the site.
| Flow | Restricted transfer? | Basis | Action |
|---|---|---|---|
| UK host, data centres in the UK, no overseas support access | No | Not needed | Keep the host's sub-processor list on file. |
| Help desk, tickets stored in Ireland | Yes | UK adequacy regulations for the EEA | Record it and mention it in the policy. |
| US email platform, certified with the UK Extension | Yes | UK Extension to the Data Privacy Framework | Save the listing; note the Addendum in its terms as a fall-back. |
| Freelance developer in South Africa with admin access | Yes | IDTA, as no UK adequacy regulations apply | Complete the IDTA with the developer, record a risk assessment, and limit their access to what the work needs. |
The last row is the one most often missed. Access by an overseas contractor is easy to forget because nothing is visibly sent. It is also the easiest to reduce: a staging copy of the site with fake customer data often removes the need for them to see real orders at all.
Situations that need extra care
- You are also subject to the EU GDPR. If you target customers in the EU, EU rules may apply to that data too. Transfers from the EU to the UK are covered by the EU's adequacy decisions for the UK, but your onward transfers from the UK may need to satisfy both regimes, which is where the Addendum helps.
- Suppliers acting as controllers. Payment providers and some advertising platforms act as independent controllers for part of their processing. A transfer to them still needs a basis, even though it is not a processor relationship.
- Special category data. Health, biometric and similar data raises the risk in any assessment, and may call for stronger measures or keeping the data in the UK.
- Relying on consent. Explicit consent is an exception for occasional transfers, and the person must be told of the risks. It is not a practical basis for running your email marketing or hosting.
1. Is using a US company like an email platform a restricted transfer?
Usually yes, if the company stores or accesses the personal data in the US, or if its support staff there can see it. The transfer is lawful if the company is certified to the Data Privacy Framework and has signed up to the UK Extension, or if its data processing terms include the IDTA or the UK Addendum. Check which applies, keep evidence, and mention the transfer and its safeguard in your privacy policy.
2. What is the UK-US data bridge?
It is the name commonly used for the UK Extension to the EU-US Data Privacy Framework, which the UK recognised through adequacy regulations that took effect in October 2023. It lets UK organisations send personal data to US companies that have self-certified to the Data Privacy Framework and opted into the UK Extension, without a separate transfer contract. It does not cover every US company, so check the official participant list for each supplier.
3. What is the difference between the IDTA and the Addendum?
The IDTA is a standalone UK contract for restricted transfers. The Addendum is a shorter document that attaches to the European Commission's standard contractual clauses and adapts them for transfers from the UK. They achieve the same purpose. The Addendum is usually more convenient for suppliers that already use the EU clauses with EU customers, while the IDTA suits UK-only arrangements, such as a contract with a single overseas freelancer.
4. Do I need a transfer risk assessment for every supplier?
Not for transfers covered by UK adequacy regulations or the UK Extension to the Data Privacy Framework, because the government has already assessed those. When you rely on the IDTA or the Addendum, you are expected to consider whether the data will be protected in practice in the destination. The Data (Use and Access) Act 2025 revises the standard used, so follow the ICO's current guidance and tool, and keep the assessment proportionate to the risk.
5. Can EU companies receive UK personal data freely?
Yes, in the sense that transfers from the UK to the European Economic Area are covered by UK adequacy regulations, so no extra contract is needed for the transfer itself. You still need a processing contract with any supplier that handles data for you, and you should still mention the transfer in your privacy policy. The same applies to the other countries the UK recognises, whose list you should check on GOV.UK or the ICO website.
6. Does a freelancer abroad who can see my customer data count?
Yes. Making personal data accessible to a separate person outside the UK is a restricted transfer, even if they only view it in your admin panel and never download anything. If their country is not covered by UK adequacy regulations, use the IDTA, which the ICO publishes as a template you can complete. Also limit what they can see, for example by giving them a staging site with fake data rather than live customer records.
7. What should my privacy policy say about international transfers?
It should say that data is transferred outside the UK, name the countries or regions involved where you can, and state the safeguard for each, such as UK adequacy regulations, the UK Extension to the Data Privacy Framework, or the IDTA or Addendum. It should also explain how people can get a copy of, or more information about, the safeguards. Keep it specific and update it whenever you add a supplier that stores data abroad.
The GDPR Audit checks what a visitor can see: the cookie banner, the scripts that load before consent, the privacy policy and the routes people have to exercise their rights, and lists each finding with the guide that fixes it.
Open GDPR Fixes →