International Data Transfers Compliance Check

Why this matters

UK GDPR restricts transferring personal data outside the UK unless an appropriate safeguard is in place. Most small businesses do this without realising it — using US-based email, CRM, HR or cloud storage tools, or outsourcing customer support overseas — because “transfer” includes remote access to data, not just physically sending it. Where the destination country doesn’t have UK “adequacy” status, businesses need a recognised transfer mechanism: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU’s Standard Contractual Clauses, or reliance on a specific adequacy regulation, such as the one covering the UK-US Data Bridge for US organisations certified under the Data Privacy Framework.

The UK-US Data Bridge, live since October 2024, makes transfers to certified US organisations more straightforward, but it only applies where the receiving US company has actually self-certified — a check many businesses skip, wrongly assuming any US provider is automatically covered. Meanwhile, the Data (Use and Access) Act 2025 introduced a new “data protection test” for future UK adequacy decisions, and the EU periodically reviews the UK’s own adequacy status, both of which can change what safeguards businesses relying on EU data need going forward. Getting the transfer mechanism wrong doesn’t just risk ICO enforcement — it can also leave contracts with suppliers or customers technically unenforceable on data protection terms.

What you'll need

• A rough list of the third-party tools/suppliers you use that may store or process personal data (email, CRM, HR, hosting, analytics)
• Knowledge of where those suppliers are based or host their data (UK, EU, US, elsewhere)
• Any data processing agreements or contracts you hold with overseas suppliers, if available
• Whether any staff, contractors or offices are based outside the UK

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.