International transfers of personal data under the GDPR
International transfers of personal data under the GDPR

The following Employment guidance note provides comprehensive and up to date legal information covering:

  • International transfers of personal data under the GDPR
  • Key guidance
  • The GDPR and its incorporation into the EEA Agreement
  • Obligations on data exporters under the GDPR
  • Identifying an international transfer
  • The data export restriction
  • Adequacy decisions
  • Appropriate safeguards
  • Instruments between public authorities or bodies
  • Standard contractual clauses (Model Clauses)
  • more

This Practice Note introduces the general prohibition under Chapter V of the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) on the cross-border transfer of personal data outside of the EEA or to an international organisation.

For more information on the data protection regime under the GDPR, and the Data Protection Act 2018 (DPA 2018), which implements provisions and permitted derogations to the GDPR into UK law, see Practice Notes:

  1. The General Data Protection Regulation (GDPR)

  2. The Data Protection Act 2018

  3. Key definitions under the GDPR

  4. Data protection principles under the GDPR

  5. Extra-territorial reach under the GDPR

For a comparison between the position under the GDPR and the preceding data protection regime, see Practice Note: GDPR comparison—international data transfers of personal data [Archived].

For a comprehensive introduction to the GDPR, collating key practical guidance, see: GDPR toolkit.

Key guidance

The GDPR is a complex and principles-based regulation, the text of which lacks clarity in a number of areas and upon which there is often limited guidance from regulators, such as the Information Commissioner’s Office (ICO), the Article 29 Working Party (the Working Party), the European Data Protection Board (EDPB) or the European Commission (the Commission). This Practice Note has been drafted in line with the provisions of the GDPR and on the basis of guidance in relation to the preceding data protection regime