International data transfers

Sending personal data outside the UK or the European Economic Area is a restricted transfer, lawful only to an approved destination, under safeguards such as standard clauses (UK GDPR Article 46, EU GDPR Article 46), or under a narrow exception. The UK rewrote its other transfer articles in 2026; the EU’s are unchanged.

The requirement in plain English

A restricted transfer happens when you send personal data, or make it accessible, to a recipient in another country who is not part of your own organisation. Remote access counts: a supplier’s support engineer in another country reading your database is a transfer even if the data never moves. Both regimes then offer three routes, with the exceptions as a last resort.

An approved destination. The country, or a scheme within it, has been found to protect data to the required standard.
Appropriate safeguards. You put a recognised instrument in place, usually standard contractual clauses or binding corporate rules, and assess whether it works in the destination.
An exception. For occasional transfers only, a derogation such as explicit consent, a contract with the person, or legal claims.

Whichever route you use, the rest of the regulation still applies: you need a lawful basis, the transfer goes in your record of processing and your privacy notice, and the recipient is bound by contract.

UK GDPR

Since 5 February 2026, a new Article 44A of the UK GDPR sets the general rule and Articles 45A to 45C replace the old adequacy article. The government approves destinations by regulations, still called adequacy regulations in ICO guidance, after applying the data protection test in UK GDPR Article 45B: whether protection there is not materially lower than in the UK. The European Economic Area is approved, and so are US companies certified to the UK Extension to the EU–US Data Privacy Framework.

For safeguards (UK GDPR Article 46), the main instruments are the International Data Transfer Agreement (IDTA), the UK Addendum to the EU standard contractual clauses, and binding corporate rules (UK GDPR Article 47). You may rely on one only if, acting reasonably and proportionately, you consider the data protection test is met for that transfer. The ICO still calls that assessment a transfer risk assessment, and the effort it expects scales with the data and the risk. Exceptions sit in UK GDPR Article 49.

EU GDPR

EU GDPR Article 44 sets the general principle. The European Commission adopts adequacy decisions (EU GDPR Article 45); among them are the UK, renewed in December 2025 until 27 December 2031, and the United States for companies certified to the EU–US Data Privacy Framework, a decision under appeal at the Court of Justice in 2026.

For safeguards (EU GDPR Article 46), most organisations use the standard contractual clauses adopted in 2021 (Implementing Decision (EU) 2021/914), choosing the module that fits the parties’ roles, or binding corporate rules (EU GDPR Article 47). Before relying on them you assess whether the destination’s law, especially public authority access, lets the clauses work, and add supplementary measures if not: the transfer impact assessment that followed the Schrems II judgment. Exceptions sit in EU GDPR Article 49.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person UK analytics company with clients in France keeps a transfer register alongside its record of processing. Each row names the recipient, the country, what is sent or accessed, the role of the recipient, and the route relied on.

For its US cloud provider, the register points to the provider’s certification under the UK Extension and, for EU client data, under the EU–US Data Privacy Framework, with the date each was last checked on the official list. For a support contractor in India, it points to the signed IDTA and a two-page transfer risk assessment covering the data involved, the access controls, encryption and the local law, reviewed each year.

New suppliers cannot be approved until the privacy lead has filled in the transfer row. When a supplier announces a new sub-processor abroad, the same check runs before the objection window closes. The privacy notice lists the countries and safeguards in plain words, and staff know where to find the signed instruments if a client asks.

Evidence an auditor expects

Transfer register or mapping: usual; the auditor checks every recipient abroad in the record of processing appears with its route.
Signed instruments: required where you rely on safeguards; the auditor checks the IDTA, Addendum or clause module matches the parties’ roles.
Transfer risk or impact assessments: required in substance for the safeguards route; the auditor looks for reasoning proportionate to the risk.
Approval checks: usual; evidence that a recipient was certified, or a country approved, at the date of transfer.
Exception justifications: required where you rely on Article 49; the auditor checks the transfer was occasional and the derogation fits.
Privacy notice entries: required; the auditor checks transfers are disclosed.

Common mistakes

Forgetting remote access

Teams map where data is stored and forget who can reach it. Support, development and administration access from abroad are transfers; ask suppliers where their staff sit.

Clauses signed, assessment never done

Standard clauses without a transfer risk or impact assessment meet only half the requirement. Keep the assessment with the signed clauses, scaled to the data.

Using the EU clauses alone for UK transfers

The EU standard contractual clauses do not cover a transfer from the UK on their own. Add the UK Addendum, or use the IDTA.

Exceptions are for occasional cases. A daily data feed to an offshore team needs a safeguard, not a consent box.

Not checking certification

A US company is approved only while it is certified, and only for the data its certification covers. Check the official list and note the date.

How Sted helps

Sted’s knowledge base includes a Cloud System Record (REC-CSR) under the Cloud Computing Policy (POL-CLD), which records the regions a cloud service uses and, for each transfer of personal data outside the UK or the European Economic Area, the mechanism relied on, the signed instrument and the transfer impact assessment behind it.
Records are part of the Full Management System plan.
Onboarding asks about the personal data you process, activity by activity (its purpose, who it is about, how long it is kept and whether you act as controller or processor), and about transfers abroad with their safeguard; Summary’s Data and privacy card lists the processing activities by name and status and each transfer’s recipient, role and destination.
The card is a summary of what onboarding recorded, not a record of processing activities.
Sted’s Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals’ rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.
Your data is stored in London (AWS eu-west-2), where Sted’s service runs.

Sted does not assess destination countries or carry out transfer risk assessments for you. You make and record those judgements.

International transfer: the term defined.
Processors and data processing agreements: the contract a processor abroad also needs.
Supplier due diligence: where the transfer check fits in supplier approval.
Data (Use and Access) Act 2025 changes: the UK’s new transfer articles in context.
Where your data lives: where Sted itself stores and processes your data.

Frequently asked questions

Is sending data from the UK to the EU a restricted transfer?

No. The UK treats the countries of the European Economic Area as approved destinations, so data can flow there without extra safeguards. The EU, in turn, renewed its adequacy decision for the UK in December 2025, running to 27 December 2031.

Does a US cloud provider with servers in London make a transfer?

Often it still does. If staff or systems in the US can access the data, for support or administration, that access counts as a transfer even though the data is stored in London. Check the provider’s agreement and sub-processor list for where access happens.