International Data Transfers

Transferring personal data outside the UK and EU can be risky and can result in a data breach fine where the transfer does not meet at least one of the following three conditions:

• The transfer is required for law enforcement purposes.

• The transfer is to a country that is approved by the ICO or EU as meeting data protection adequacy, or where other appropriate safeguards have been put in place.

• The transfer is to a relevant authority in the third country, or is a ‘relevant international organisation’ that carries out functions for any of the law enforcement purposes.

Whilst in many cases it is still possible to transfer personal data with the right documentation, it should be noted that without putting in place documents like an International Data Transfer Agreement or Standard Contractual Clauses, is it not lawful to transfer personal data (except for law enforcement purposes) to the United States, Australia or India along with a whole host of other places like China.

For detailed guidance and help with drafting the appropriate documentation please contact Boardroom Matters.