This Practice Note is intended for in-house lawyers and privacy and compliance professionals in private sector commercial organisations in the UK. It provides guidance on how to manage international transfers of personal data and explains the legal and practical challenges organisations face relation to international data transfers. It reflects ICO guidance on international transfers, including in relation to transfer risk assessments (TRAs).

This Practice Note is not intended for public sector organisations.

This Practice Note reflects the United Kingdom General data protection Regulation (UK GDPR) and Information Commissioner’s Office (ICO) guidance on International transfers, including ICO guidance on Transfer risk assessments. See also Practice Note: How to complete a transfer risk assessment—international data transfer—ICO methodology.

This Practice Note also signposts key EU guidance in relation to transfer impact assessments (TIAs), which is the EU equivalent of a transfer risk assessment. See also Practice Note: How to complete a transfer impact assessment—international data transfer—EU methodology and Precedents: Transfer impact assessment—personal data—EU methodology, which reflects the EU approach to TIAs and International data transfer—data