International transfers

This subtopic is intended for private sector commercial organisations in the UK and reflects the UK GDPR. It sets out the legal and practical challenges organisations face when transferring data outside the UK and suggests some risk management measures you may wish to adopt.

The data protection regime on international transfers

All transfers of personal data are subject to the general requirements of Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR), eg you must:

•
have a lawful ground for processing that personal data—see Practice Note: How to process personal data lawfully
•
provide certain information to data subjects—see Practice Note: Privacy notices—information requirements, and
•
(where the transfer poses a high risk) complete a data protection impact assessment—see Practice Note: How to complete a data protection impact assessment—DPIA

Where you transfer the personal data internationally (outside the UK), you must also satisfy and comply with requirements in Chapter V of the UK GDPR (Transfers of personal data to third countries or international organisations).

To comply with these requirements, you should consider:

•
is the transfer caught by the data protection

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Risk & Compliance News

ICO issues guidance on 'Consent or Pay' Models for online tracking

The Information Commissioner's Office (ICO) has published comprehensive guidance on 'consent or pay' business models for online tracking. The guidance addresses compliance with data protection law, focusing on key areas such as power imbalance, appropriate fees, equivalence, and privacy by design. ICO has outlined methods for assessing power imbalance, including market position and barriers to switching, as well as determining appropriate fees and ensuring equivalence between options. The guidance also emphasizes the importance of privacy by design principles in implementing these models and cautions against offering them to children.

Risk & Compliance weekly highlights—23 January 2025

This week's edition of Risk and Compliance weekly highlights includes: a new Risk & Compliance forecast, the latest on data protection, compliance trends in 2025 and key points from the trade sanctions office.

ICO launches strategy to tackle online tracking compliance in UK

The Information Commissioner's Office (ICO) has announced a comprehensive strategy to address online tracking compliance across the UK's digital landscape. The ICO has expanded its focus from the top 200 to the top 1,000 UK websites, aiming to ensure meaningful user control over personal data tracking. The strategy includes new guidance on 'consent or pay' models, plans to tackle compliance in apps and connected TVs, and investigations into data management platforms in the adtech ecosystem. The ICO has also committed to publishing public-facing guidance to help individuals navigate their rights regarding online tracking.

SFO’s first UWO hints at new strategy in hunt for illicit funds

Law360, London: The first unexplained wealth order (UWO) secured by the Serious Fraud Office (SFO), against the former wife of a convicted solicitor, suggests that the agency is thinking creatively about how to use the dirty-money tools at its disposal, although lawyers wonder whether it will be a durable strategy.

View Risk & Compliance by content type :

News