# International transfer decision and TRA worksheet

Follow the actual legal entities and access arrangements, then identify the transfer route and evidence needed. Use the official IDTA or Addendum where appropriate; this worksheet is not a transfer contract.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Apply the restricted-transfer test

- Record whether UK GDPR applies to the processing, whether you initiate a transfer or access outside the UK, and whether the receiver is a separate legal entity.
- Identify remote support and onward access as well as hosting. A UK server does not rule out an overseas transfer.
- Identify the exporter, importer and their roles rather than relying on a product or group brand.

Transfer ID / purpose / activity ID: 
Exporter legal entity and role: 
Importer legal entity and role: 
UK GDPR / initiation / separate entity analysis: 
Data subjects and information categories: 
Storage / access / onward-transfer locations: 

## 2. Identify the permitted mechanism

- Check current UK adequacy coverage and all limitations. UK–US bridge reliance requires the correct recipient, active UK Extension participation and covered data.
- Where using safeguards, select the relevant route and record the official instrument and completion requirements. EU SCCs alone do not cover UK restricted transfers.
- Treat Article 49 exceptions as specific, condition-dependent routes; do not use them as an unexplained default for routine services.

Adequacy / safeguard / exception route: 
Official legal or regulator source: 
Coverage / certification check and date: 
IDTA or Addendum / SCC module references: 
Exception conditions and reasoning if relevant: 
Missing evidence and blocking issues: 

## 3. Assess protection and the TRA

- Where relying on appropriate safeguards, assess whether protection after transfer is materially lower than UK protection, acting reasonably and proportionately.
- Record the nature and sensitivity of the information, destination context, enforceability and relevant third-party or government access risks.
- Explain the assessment method, sources, assumptions and uncertainties. If using the ICO tool or government analysis, document its fit to the particular transfer.

TRA method and source versions: 
Nature, scale and sensitivity: 
Destination risks and supporting evidence: 
Enforceability and practical remedies: 
Assumptions / uncertainty / additional enquiries: 
Initial data-protection-test conclusion: 

## 4. Specify safeguards and contract actions

- Assign technical and organisational measures such as minimisation, access restriction and encryption where appropriate; describe their effectiveness in this scenario.
- Complete the relevant IDTA/Addendum tables and mandatory terms using the official documents. Record actual execution evidence separately.
- Check Article 28 terms, authorised subprocessors, onward-transfer controls and obligations to notify material changes.

Supplementary measure / owner / evidence: 
Article 28 contract reference: 
Official transfer document version: 
Completion and execution status: draft / signed / other: 
Binding agreement evidence and parties: 
Onward-transfer and subprocessor controls: 

## 5. Decide whether to proceed

- Record whether the mechanism and safeguards actually cover the transfer. Resolve material gaps before access is enabled.
- Explain residual risks and the reasoned data protection test outcome where required.
- Record approval evidence and conditions; a draft signature field does not establish a binding contract.

Decision: proceed / conditional / pause: 
Data protection test rationale where applicable: 
Outstanding controls and conditions: 
Approver / evidence / date: 
Access-enable gate: 
Privacy notice and ROPA updates: 

## 6. Monitor changes

- Assign periodic review and event triggers: certification, law, destination, data, service, support or subprocessor changes.
- Keep the mechanism and recipient evidence current. Record escalation if a route no longer covers the transfer.
- Check actual data flows against the approved arrangement.

Review owner and frequency: 
Trigger events: 
Certification or legal-change monitoring: 
Actual-flow verification: 
Escalation and suspension procedure: 
Last review / outcome / next date: 

## Sources

- ICO: International transfer test: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-guide-to-international-transfers/what-is-an-international-transfer-of-personal-information/
- ICO: Transfer rules and data protection test: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-guide-to-international-transfers/how-do-we-comply-with-the-transfer-rules-if-were-initiating-the-restricted-transfer/
- Official UK IDTA and Addendum documents: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/