International Transfer of Personal Data - a practical guide
Universities regularly work with overseas partners, research collaborators, suppliers and cloud service providers. If you are sharing personal data outside the UK, or allowing it to be accessed from another country, you may need to complete additional checks before proceeding.
Additional UK GDPR requirements may apply to ensure the information continues to receive an appropriate level of protection. Individuals entrust the University with their personal data, and the University must ensure that any organisation receiving or accessing that data provides a level of security and safeguarding comparable to that required in the UK.
This guide explains how to identify international transfers, complete the required checks, and when to seek advice before sharing personal data.
What will I learn from this guidance?
This guide will help you:
- identify whether an international transfer is taking place;
- understand what checks you need to complete before sharing personal data;
- determine whether additional transfer safeguards are required;
- understand when risk assessments may be needed; and
- know where to obtain advice and support.
What is an International Transfer?
An international transfer occurs when personal data is sent, shared, stored or made accessible outside the UK. This may include sharing personal data with:
- overseas universities;
- international research partners;
- cloud service providers; or
- suppliers with staff located overseas
An international transfer can also occur where personal data remains in the UK but is accessible by an organisation located in another country.
Why is this important?
Data protection and privacy requirements vary between countries. Before sharing personal data internationally, ensure the transfer is necessary, proportionate to the purpose and that any privacy risks have been considered and appropriately managed. You should also be satisfied that personal data will be handled to a standard that is comparable to the protections it would receive if it were processed in the UK.
What should I do?
In most cases, the key questions are: What personal data is being shared, who is receiving it, where is it going, and are any additional safeguards required?
Before transferring personal data outside the UK, you should:
- Identify the personal data involved
- Identify who will receive the data and their role.
- Confirm which country or countries will access, store or process the data.
- Check whether UK adequacy regulations apply.
- Determine whether additional transfer safeguards are required.
- Complete a Data Protection Test (DPT) / Transfer Risk Assessment (TRA) where applicable.
- Contact the Data Protection Team if you are unsure.
International transfers must be appropriately documented to demonstrate compliance with UK GDPR and the University's accountability obligations.
Ensure you record:
- who personal data is shared with;
- which country or countries can access, store or process the data;
- the purpose of the transfer;
- the safeguard relied upon (for example, UK Adequacy Regulations, IDTA or UK Addendum); and
- any supporting assessments or agreements completed.
You should also ensure that relevant privacy notices explain:
- where personal data is transferred;
- why the transfer is necessary; and
- what safeguards are in place to protect the information.
Follow the process
Step 1: Identify the personal data
Identify the personal data that will be transferred and ensure that only the information necessary for the intended purpose is shared.
Examples may include:
- names and contact details;
- student records;
- employment information;
- research participant data; and
- user account information.
Identify whether any special category personal data is involved, such as:
- health information;
- racial or ethnic origin;
- religious or philosophical beliefs;
- biometric data; and
- trade union membership.
Special category data is considered particularly sensitive in law and may present higher risks if misused, lost or accessed without authorisation. Additional safeguards and assessments may therefore be required before the information is transferred internationally.
For further information see:
Step 2: Identify the recipient
Before sharing personal data internationally, identify who will receive the personal data and understand their role in relation to the information.
Understanding the recipient's role is important because it determines:
- who is responsible for the personal data;
- what the recipient can do with the information;
- what contractual arrangements may be required; and
- whether additional international transfer safeguards are needed.
| Recipient Type | Description | Examples | Typical Agreement |
|---|---|---|---|
| Joint Controller | Both organisations jointly decide how and why personal data is processed. |
|
Joint Controller Agreement (JCA) |
| Independent Controller | The recipient uses the personal data for its own purpose |
|
Data Sharing Agreement (DSA) |
| Data Processor | The recipient processes data on the University's behalf and under its instructions. |
|
Data Processing Agreement (DPA) |
Step 3: Identify where the data will be processed
Identify all countries where personal data will be:
- stored;
- accessed;
- processed; or
- transferred.
This includes cloud-hosted services and suppliers that may access personal data from outside the UK. Different countries provide different levels of legal protection, which may affect the safeguards required for the transfer.
Check whether a country is covered by UK adequacy regulations:
Step 4: Check whether UK adequacy regulations apply
Countries covered by UK adequacy regulations are generally the simplest type of international transfer because additional transfer safeguards are not usually required.
Transfers to the USA
Before transferring personal data to US organisation, verify whether it participates in the UK Extension to the EU-US Data Privacy Framework.
The EU-US Data Privacy Framework (DPF) and the UK Extension to the EU-US Data Privacy Framework allow UK organisations to transfer personal data to certain US organisations without requiring additional international transfer safeguards, provided the organisation has self-certified under the framework and appears on the official DPF list.
You should still ensure the transfer is necessary, complies with UK GDPR requirements, and that the organisation's certification is active and covers the type of data being transferred.
To check whether a USA organisation is certified, use the Data Privacy Framework Participant Search.
If the recipient is based in the USA and is not certified Data Privacy Framework, you must use an approved international data transfer mechanism before sharing personal data.
Step 5: Apply transfer safeguards where required
If UK adequacy does not apply, you will normally need an approved transfer mechanism.
Examples include:
- International Data Transfer Agreement (IDTA)
- EU Standard Contractual Clauses (SCCs) and UK Addendum to the EU Standard Contractual Clauses (SCCs)
These mechanisms establish contractual safeguards designed to protect personal data when it is transferred outside the UK.
You should also assess:
- the destination country;
- the recipient organisation;
- national data protection and human rights protections, both in law and in practice;
- the type of personal data involved; and
- any technical or organisational safeguards in place.
Contracts alone do not automatically make a transfer compliant.
Step 6: Assess the risks
You will need to complete a Data Protection Test (DPT), also known as a Transfer Risk Assessment (TRA) where you are transferring personal data to a country isn’t covered by UK adequacy regulations.
This assessment helps determine whether the personal data will receive an appropriate level of protection in the destination country.
Consider:
- the type and sensitivity of the personal data;
- the purpose of the transfer;
- the recipient organisation;
- any onward transfers;
- local laws and government access powers; and
- whether additional safeguards are needed.
Transfers involving special category data, criminal offence data, vulnerable individuals or large volumes of personal data may require additional scrutiny and may also trigger the need for a Data Protection Impact Assessment (DPIA).
Transfers to the USA
For transfers of personal data to the USA, you may make reference to the UK Government's assessment, rather than completing your own Data Protection Test:
Step 7: Ensure appropriate security and retention arrangements
Before sharing personal data internationally, ensure suitable technical and organisational measures are in place.
Examples include:
- encryption;
- access controls;
- information security training;
- incident management procedures; and
- data minimisation measures.
You should also:
- identify how long the information will be kept;
- ensure data is not kept longer than necessary; and
- arrange secure deletion, return or disposal of personal data when it is no longer required.
Take extra care when sharing
Take extra care when transferring:
- student records;
- disability and adjustment information;
- health and welfare information;
- research participant data;
- children’s data
- international exchange information; and
- special category personal data.
Review international research collaborations, overseas partner institutions, cloud services and overseas suppliers to ensure appropriate transfer arrangements are in place before sharing personal data.
Practical examples
The examples below show how international transfer requirements can vary depending on the data being shared, the recipient organisation and the destination country.
| Example 1: Straightforward Transfer | Example 2: More Complex Transfer | |
|---|---|---|
| Scenario | A researcher shares participant contact details with a university in France as part of a collaborative research project. | A research team wishes to use a cloud-based survey platform located in a country that is not covered by UK adequacy regulations to collect participant health information. |
| International Transfer? | Yes | Yes |
| Does UK adequacy apply? | Yes | No |
| Special Category Data involved? | No | Yes |
| Additional transfer safeguards required? | Generally not required. | Likely to be required. |
| Other considerations | A Data Sharing Agreement (DSA) may still be required. | A DPT/TRA should be completed and a DPIA may also be required. |
| What should you do? | Ensure the transfer is necessary, document the arrangement appropriately and maintain records of the sharing activity. | Contact the Data Protection Team before using the service so that risks can be assessed and appropriate safeguards implemented. |
Decision guide
Will personal data be stored, accessed or shared outside the UK?
Action:
If no, international transfer requirements do not apply. If yes, continue.
Is the destination covered by UK adequacy regulations?
Action:
If yes, additional transfer safeguards are generally not required. If no, continue.
Does the transfer involve special category personal data?
Action:
Consider whether a DPT/TRA and DPIA are required.
Further advice and support
International transfers can be complex, particularly where research collaborations, cloud services, overseas suppliers or multiple jurisdictions are involved.
If you are unsure whether an international transfer is taking place, whether adequacy regulations apply, whether a DPT/TRA is required, or which safeguard should be used, contact your Data Co-ordinator or the Data Protection Team before transferring personal data.