International transfer
An international transfer is sending personal data, or making it accessible, to a recipient abroad who is not part of your own organisation: outside the UK under UK GDPR, outside the European Economic Area under EU GDPR. UK guidance calls it a restricted transfer. It is lawful only to an approved destination, under recognised safeguards, or under a narrow exception.
- Clauses
- UK GDPR Article 44A · UK GDPR Article 45B · UK GDPR Article 46 · EU GDPR Article 44 · EU GDPR Article 46
Where the term appears
Since 5 February 2026, UK GDPR Article 44A sets the UK’s general rule, and the government approves destinations after applying the data protection test in UK GDPR Article 45B: protection there must not be materially lower than in the UK. UK GDPR Article 46 covers safeguards such as the International Data Transfer Agreement and the UK Addendum to the EU clauses. EU GDPR Article 44 sets the EU principle, EU GDPR Article 46 the safeguards, chiefly the 2021 standard contractual clauses. The international transfers page covers each route.
Who is on the other end
Auditors test the recipient, not the location of the screen. Your own employee working from abroad, logged in to your systems, is still inside your organisation, so there is no transfer. A supplier’s support engineer abroad reading your database is a transfer, even though the data never moves. Map each supplier’s access, including its sub-processors.
How Sted uses it
- Your data is stored in London (AWS eu-west-2), where Sted’s service runs.
- Sted’s knowledge base includes a Cloud System Record (REC-CSR) under the Cloud Computing Policy (POL-CLD), which records the regions a cloud service uses and, for each transfer of personal data outside the UK or the European Economic Area, the mechanism relied on, the signed instrument and the transfer impact assessment behind it.
- Records are part of the Full Management System plan.
Sted does not assess destination countries or carry out transfer risk assessments for you. You make and record those judgements.
Related terms
- Controller and processor: processors abroad are the commonest source of transfers.
- Records of processing activities (ROPA): lists each transfer and its safeguard.
- Personal data: what is being transferred.
- Lawful basis: a transfer needs one as well as a transfer route.