UK international data transfers: adequacy, IDTA, Addendum and TRA

Under UK GDPR, a restricted transfer must be covered by one of three routes: UK adequacy regulations, appropriate safeguards such as the IDTA, the Addendum or UK binding corporate rules, or a listed exception. If you use a safeguard, you must also complete a transfer risk assessment.

What counts as a restricted transfer

The ICO describes it as a transfer of personal information to a separate organisation outside the UK, where UK GDPR applies, you initiate the transfer and the receiver is a separate legal entity. Transfer covers sending information and making it accessible. The rules apply even to small or infrequent transfers.

The three routes

1. Adequacy. UK adequacy regulations exist for the destination. This is the simplest route, though you still need to meet your other UK GDPR duties.
2. Appropriate safeguards. These are listed in Article 46 and bind you and the receiver to protect the data. The options include the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum and UK binding corporate rules. You must also complete a TRA.
3. Exceptions. Article 49 derogations. You generally need to show the exception is necessary and proportionate.

If none of the three applies, you must not make the transfer.

IDTA or Addendum

Both are safeguard options the ICO provides. Which one fits depends on your contracts and your counterparty. Ask your counsel and read the ICO's current guidance, because this post does not reproduce the documents.

The transfer risk assessment

The ICO says a TRA is required when you rely on a safeguard. It checks that the protection for people's information will not be materially lower after the transfer. The ICO's international transfers guidance is revised from time to time, so check its pages before you finalise your approach.

Who in your company owns this

Transfers happen in procurement, engineering and support, so the privacy lead rarely sees them all. Add a transfer question to your vendor intake form: where is the data stored, and who can reach it from outside the UK? Ask the same of any contractor or support team that can open customer records. Then the register of transfers builds itself as vendors are approved, and the TRA is prompted by the intake rather than found by accident in an audit.

A checklist

1. List recipients outside the UK, including support staff with remote access.
2. Check whether adequacy regulations cover each country.
3. Where they do not, pick IDTA, Addendum or BCRs and sign it.
4. Complete and file a TRA for each safeguard based transfer, and date it.
5. Reflect transfers in your privacy notice and record of processing.
6. Re-check when the vendor, country or data type changes.

Quick check

Sources

• ICO, a brief guide to international transfers

Last reviewed: 19 October 2026.