The ICO has published new guidance on international data transfers. The rules have not changed, but the guidance is aimed at clarifying the existing rules with some real-world examples.
Just as a reminder, the transfer rules apply when you send (or make accessible) personal information and all the following conditions are met:
- the UK GDPR applies to your processing of the personal information you are sending
- you are initiating the transfer of personal information to an organisation outside of the UK
- the organisation receiving the information is a separate legal entity to you
This is called a restricted transfer, and every restricted transfer must be covered by one of the following transfer mechanisms:
- UK adequacy regulations
- appropriate safeguards
- an exception (called a “derogation”)
You can read the updated guidance at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/