# International transfer

Sending personal data, or giving access to it, to a recipient in another country, which UK GDPR and EU GDPR allow only by an approved route.

Source: https://sted.digital/docs/glossary/international-transfer · Last reviewed 17 October 2026 · Strand Glossary

An international transfer is sending personal data, or making it accessible, to a recipient abroad who is not part of your own organisation: outside the UK under UK GDPR, outside the European Economic Area under EU GDPR. UK guidance calls it a restricted transfer. It is lawful only to an approved destination, under recognised safeguards, or under a narrow exception.

## Where the term appears

Since 5 February 2026, UK GDPR Article 44A sets the UK's general rule, and the government approves destinations after applying the data protection test in UK GDPR Article 45B: protection there must not be materially lower than in the UK. UK GDPR Article 46 covers safeguards such as the International Data Transfer Agreement and the UK Addendum to the EU clauses. EU GDPR Article 44 sets the EU principle, EU GDPR Article 46 the safeguards, chiefly the 2021 standard contractual clauses. The [international transfers page](/docs/standards/gdpr/international-transfers) covers each route.

### Who is on the other end

Auditors test the recipient, not the location of the screen. Your own employee working from abroad, logged in to your systems, is still inside your organisation, so there is no transfer. A supplier's support engineer abroad reading your database is a transfer, even though the data never moves. Map each supplier's access, including its sub-processors.

## How Sted uses it

Your data is stored in London (AWS eu-west-2), where Sted's service runs.
Sted's knowledge base includes a Cloud System Record (REC-CSR) under the Cloud Computing Policy (POL-CLD), which records the regions a cloud service uses and, for each transfer of personal data outside the UK or the European Economic Area, the mechanism relied on, the signed instrument and the transfer impact assessment behind it.
Records are part of the Full Management System plan.

Sted does not assess destination countries or carry out transfer risk assessments for you. You make and record those judgements.

## Related terms

- [Controller and processor](/docs/glossary/controller-and-processor): processors abroad are the commonest source of transfers.
- [Records of processing activities (ROPA)](/docs/glossary/records-of-processing): lists each transfer and its safeguard.
- [Personal data](/docs/glossary/personal-data): what is being transferred.
- [Lawful basis](/docs/glossary/lawful-basis): a transfer needs one as well as a transfer route.