International transfers
Moving personal data out of the EEA or the UK needs a lawful route. There are only a handful, and which one fits depends on where the data is going and who is receiving it.
Transfer mechanisms
| Mechanism | Legal basis | What it is | Best for | Watch-outs |
|---|---|---|---|---|
| Adequacy decision | GDPR Art 45; UK GDPR Art 45 | a Commission (EU) or Secretary of State (UK) determination that a third country ensures essentially equivalent protection, permitting transfers without further safeguards | Transfers to countries/sectors with a current decision (e.g. EU-Brazil from 2026-01-26; UK renewed to 2031-12-27) | Decisions are periodic and reviewable; can be annulled (Schrems II) or expire (sunset/four-year review clauses). Scope can be sectoral or exclude e.g. law-enforcement transfers. |
| Standard contractual clauses (SCCs) | GDPR Art 46(2)(c)-(d); EU set = Commission Implementing Decision (EU) 2021/914 | modular controller/processor clauses for transfers absent adequacy | Most third-country transfers where no adequacy exists | Require a transfer impact assessment (Schrems II) and possible supplementary measures. A revision addressing the third-country-controller (importer already subject to GDPR) gap was consulted on by the Commission; not finalised as at 2026-07-26 — verify current status. |
| UK IDTA / Addendum | UK GDPR Art 46; DPA 2018; ICO International Data Transfer Agreement and Addendum to the EU SCCs | the UK's own transfer instrument (IDTA) and an Addendum bolting UK requirements onto the EU SCCs | UK-to-third-country transfers absent UK adequacy | DUAA 2025 revised the UK transfer regime (new "data protection test" for transfers, in force 2026-02-05); the IDTA and Addendum remain valid instruments and no wholly new UK transfer instrument had replaced them as at 2026-07-26. Verify whether ICO issues updated tools post-DUAA. |
| Binding corporate rules (BCRs) | GDPR Art 47; UK GDPR Art 47 | intra-group rules approved by a supervisory authority for transfers within a corporate group | Large multinationals with frequent intra-group transfers | Slow and costly to get approved; must be approved by the lead authority (EU) or ICO (UK). Not a quick fix. |
| EU–US Data Privacy Framework | GDPR Art 45; Commission Implementing Decision (EU) 2023/1795 (2023-07-10); EO 14086; UK Extension (UK-US Data Bridge) | adequacy for transfers to US organisations self-certified under the DPF | Transfers to DPF-certified US importers | UNSETTLED: the General Court UPHELD the decision in T-553/23 Latombe v Commission (2025-09-03) but Latombe appealed to the CJEU (C-703/25 P, filed 2025-10-31), pending as at 2026-07-26. Two predecessor frameworks (Safe Harbor, Privacy Shield) were annulled — do NOT assume permanence. The UK-US Data Bridge extends the DPF for UK transfers to US organisations that have opted into the UK extension. |
| Article 49 derogations | GDPR Art 49; UK GDPR Art 49 | exceptions (explicit consent, contract necessity, important public interest, legal claims, vital interests) for transfers absent adequacy/safeguards | One-off, occasional, non-repetitive transfers | Interpreted narrowly by the EDPB; not a basis for routine or bulk transfers. Explicit-consent derogation is fragile (withdrawable). |
| Certification & codes of conduct | GDPR Arts 40-42 and 46(2)(e)-(f); UK GDPR Arts 40-42 | approved certification mechanisms or codes of conduct with binding enforceable commitments can legitimise transfers | Sector-specific transfer arrangements where a suitable scheme exists | Few approved transfer-specific certification schemes exist in practice; verify availability for the relevant sector before relying on it. |
Adequacy decisions
Jurisdictions the European Commission has found to offer essentially equivalent protection, allowing personal data to leave the EEA without further safeguards. The 31 EEA members are excluded from this list — intra-EEA transfers need no decision at all.
| Jurisdiction | Granted | Expires | Notes |
|---|---|---|---|
| Andorra | 2010 | — | Adopted under 1995 Directive (Dec. 2010/625/EU); still in force. Confirmed in Jan 2024 review |
| Argentina | 30 June 2003 | — | Argentina; 1995 Directive (Dec. 2003/490/EC). Confirmed Jan 2024 review |
| Brazil | 26 January 2026 | — | GDPR Art.45; mutual adequacy announced 27 Jan 2026. CORRECTION: Brazil now HOLDS adequacy (previously did not). 4-year periodic review |
| Faroe Islands | 2010 | — | Faroe Islands; 1995 Directive (Dec. 2010/146/EU). Confirmed Jan 2024 review |
| Guernsey | 21 November 2003 | — | Guernsey; 1995 Directive (Dec. 2003/821/EC). Confirmed Jan 2024 review |
| Isle of Man | 28 April 2004 | — | Isle of Man; 1995 Directive (Dec. 2004/411/EC). Confirmed Jan 2024 review |
| Israel | 31 January 2011 | — | Israel; 1995 Directive (Dec. 2011/61/EU). Confirmed Jan 2024 review |
| Japan | 23 January 2019 | — | GDPR Art.45; first GDPR adequacy decision and first mutual finding. 4-year review (first done 2023) |
| Jersey | 8 May 2008 | — | Jersey; 1995 Directive (Dec. 2008/393/EC). Confirmed Jan 2024 review |
| New Zealand | 2012 | — | New Zealand; 1995 Directive (Dec. 2013/65/EU, done 19 Dec 2012). Confirmed Jan 2024 review |
| South Korea | 17 December 2021 | — | South Korea; GDPR Art.45. First review concluded 2026 |
| Switzerland | 26 July 2000 | — | Switzerland; 1995 Directive (Dec. 2000/518/EC). Confirmed Jan 2024 review |
| United Kingdom | 19 December 2025 | 27 December 2031 | Renewed decisions adopted 19 December 2025 — Implementing Decision (EU) 2025/2574 under the GDPR, with a parallel decision under the Law Enforcement Directive — replacing the original 28 June 2021 decisions after a six-month bridging extension (Implementing Decision (EU) 2025/1226, 27 June to 27 December 2025). Both strands expire 27 December 2031. The UK remains the only adequacy partner subject to a sunset clause. Sunset clause: lapses 2031-12-27 unless renewed. Joint Commission/EDPB review scheduled after four years, with continuous Commission monitoring of UK legislative developments. |
| Uruguay | 21 August 2012 | — | Uruguay; 1995 Directive (Dec. 2012/484/EU). Confirmed Jan 2024 review |