International data transfer

Access can be a transfer

A restricted transfer can occur when a UK organisation sends personal data to, or makes it accessible to, a separate controller or processor outside the UK. A support team viewing worker records from another country can matter even when the server itself is in Britain.

The ICO's current transfer guide explains important boundaries. A transfer is not created merely because data travels through another country without becoming accessible there, and sending data directly to a person about themselves is not normally a restricted transfer.

Use the transfer test in order

First map the exporter, importer, destination, data and access. Then ask whether UK adequacy regulations cover the destination or arrangement. If not, identify an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and complete the required risk assessment. A narrow exception applies only in the circumstances the law sets out.

These transfer rules sit alongside the rest of data protection law. The employer still needs a lawful basis, fair notice, necessary data, security, retention and an appropriate controller-processor contract. A signed transfer clause does not repair an excessive HR data feed.

Keep the transfer visible after purchase

Record the destination, importer, purpose, data categories, people affected, mechanism, assessment date, supplementary measures and owner. Link the evidence to the processing activity and supplier record.

Review the arrangement when the provider adds a subprocessor, changes access locations or changes the service. Also watch changes to adequacy regulations and the legal environment assessed for the destination. International transfer compliance is an ongoing fact about the service, not a document collected once.