An international transfer assessment starts by determining whether a restricted transfer occurs. Identify the sender, receiver, roles and access arrangement rather than relying only on server location. The ICO provides a structured approach to identifying transfers and the routes available to support them.
Where relevant, assess UK adequacy regulations, appropriate safeguards or a permitted exception. Using standard contractual documents may require an accompanying assessment and measures appropriate to the circumstances. Do not assume EU documentation alone automatically satisfies the UK position or that every overseas access is analysed identically.
Identify the parties and the movement of information
Draw the specific arrangement before choosing a transfer document. Record which organisation sends or makes information accessible, which recipient receives it, their roles and the countries involved. Remote access can matter even when no file is deliberately emailed abroad. Conversely, not every connection with another country is analysed identically. The ICO's current brief guide gives the starting tests for identifying a restricted transfer. [1]
Separate different routes within one service. Main hosting, remote support and an onward subprocessor may involve different recipients and legal arrangements. Ask the supplier for a factual processing map rather than a statement that its product is globally compliant. Record whether support access can be restricted or whether a particular category of sensitive information can be excluded from the service entirely.
Establish the applicable transfer route
Check whether relevant UK adequacy arrangements cover the destination, recipient and activity. Avoid assuming that a country's general reputation for strong privacy rules is enough. If the proposed route uses appropriate safeguards, identify the correct UK documentation and the assessment required for the circumstances. EU contractual paperwork should not be treated as automatically resolving a separate UK transfer without checking its suitability.
A contractual safeguard is part of the assessment, not a substitute for understanding practical access. Consider the type of information, recipient's use, relevant risks and technical protections. Where an exception is proposed, obtain a specific analysis of its conditions and suitability; do not use a convenient exception as an unexamined permanent solution for routine outsourcing. Keep the conclusion tied to the actual facts and document version.
Make supplementary controls operational
Consider whether encryption, restricted access, pseudonymisation or reduced datasets can address relevant risks. Describe who holds any re-identification information or keys and whether support personnel can see readable content. Saying information is encrypted does not explain protection if the overseas recipient routinely has the means to decrypt it. Ask technical staff to describe the working design in terms the decision-maker can understand.
Record the safeguards that the customer must configure itself. A provider may offer regional controls that are not enabled by default or that apply only to selected features. Check backups, diagnostic logs and optional analytics separately. Keep a record of unavailable features and approved alternatives. This makes the assessment useful when a future administrator considers switching on a function that changes the transfer pattern.
Link the decision to contracts and notices
Ensure the processing agreement, transfer documentation and privacy explanation describe a consistent arrangement. A notice mentioning international sharing does not itself authorise it. The guide to Data processing contracts with suppliers covers the processor contract, while Data protection when using cloud software connects the assessment to cloud procurement and settings. Keep the relevant documents together so a supplier change does not update one part of the file while leaving the others obsolete.
Set change triggers for a new subprocessor, access country, processing purpose or dataset. Determine who receives supplier change notices and how the business can respond before the change takes effect. An assessment completed at purchase loses value if nobody reads later notifications. Where a change cannot be supported, identify the practical alternative, such as restricting a feature or moving the affected activity.
For Data processing agreement review, provide a recipient map and identify the precise transfer question needing resolution. Include supplier answers, proposed documents and available technical measures. Ask for a reasoned route and any implementation conditions, not simply a signature page. Keep an owner for unresolved actions and prevent the affected data flow from starting until required safeguards and decisions are in place.
Reassess the route when support arrangements change
A provider may retain the same hosting region while moving part of its support operation to another country. Ask whether the change creates new access by another organisation, changes the recipient or alters the safeguards relied upon. Keep that assessment connected to the provider's actual service description, rather than treating the original procurement approval as permanent.
Record the information needed to make the decision and the date by which the proposed change takes effect. Where important facts remain unavailable, consider whether the affected access or dataset can be limited while the issue is resolved. An updated location list is useful evidence, but it does not replace the assessment of the particular transfer arrangement.
Illustrative scenario
A UK business uses a provider whose overseas support team can access customer records. It records the recipient and access activity, then checks whether a restricted transfer arises and which route supports it. The review includes subprocessors and technical controls rather than stopping at the provider's UK sales contract.
Preparation checklist
- Map recipients, roles and countries of access.
- Apply the current restricted transfer assessment.
- Check adequacy or appropriate safeguards and necessary assessments.
- Record decisions and review changes in suppliers or locations.
Frequently asked questions
Is the supplier's UK invoice address decisive?
No. Identify the relevant recipient and processing arrangement, including access abroad. Commercial billing details do not establish where and by whom personal information is processed.
Are EU standard clauses automatically sufficient for UK data?
Check the applicable UK route and documentation. Do not assume an EU arrangement alone satisfies the UK transfer position without reviewing the actual safeguards and required assessment.
Does encryption always solve transfer concerns?
Its effect depends on implementation, including who can decrypt the information. Record the key management and access model rather than relying on the word encrypted in a brochure.
When should we reassess a transfer?
Review material changes in recipients, countries, purposes, data sensitivity or safeguards. Supplier notifications should reach an owner able to assess and respond to the changed arrangement.
Official sources
Sources checked: 8 September 2026. Check the linked guidance for subsequent changes.
General information only. The appropriate action depends on your circumstances and the applicable jurisdiction.
Report a correction