What this review helps you do
A transfer review follows who can receive or access the information, not just where the server is located. Record the organisations, countries, roles and purposes involved, then document the applicable transfer route, any required assessment and the protections that must operate in practice.
AT A GLANCE
Trace overseas hosting, suppliers and remote support. Record the transfer route, test the safeguards and resolve gaps before data moves.
The legal position
Apply the ICO’s three-part test: UK GDPR applies, you initiate access or a transfer outside the UK, and the recipient is a separate legal entity. Overseas remote access can count even when servers remain in Britain.
Use UK adequacy where its geographic and subject-matter scope covers the transfer. UK-to-EEA transfers, including Romania, are covered. EU adequacy decisions are not automatically UK adequacy decisions.
The UK–US Data Bridge covers eligible recipients actively certified for the UK Extension, within the relevant certification scope. It is not blanket US adequacy.
Where relying on appropriate safeguards, complete a reasonable and proportionate TRA meeting the statutory data protection test. Use a completed, binding UK IDTA or the UK Addendum with the 2021 EU SCCs where appropriate, plus necessary supplementary protections. EU SCCs alone do not cover UK restricted transfers.
DUAA transfer amendments commenced on 5 February 2026. The test considers whether protection after transfer is materially lower than UK protection. A TRA that already met ICO guidance does not automatically need rewriting solely because the terminology changed.
What to review
- Map exporting entities, receiving entities, data categories, purposes, hosting regions, support access and onward transfers.
- Check adequacy scope and any recipient certification against the actual service, entity and data involved.
- Review Article 28 processor terms, subcontractor controls, access safeguards and transfer documentation together.
- Assess destination risks, enforceability and practical safeguards; assign a review trigger for service, legal or subprocessor changes.
Working outputs
- Transfer register with mechanism and review owner
- Completed TRA and safeguards action list
- IDTA/Addendum completion checklist and signature record
- Data-flow map covering onward transfers
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
- Can we identify every overseas recipient and remote support location?
- Does the documented mechanism cover the actual receiving legal entity?
- Where an IDTA or Addendum is used, is it binding and fully completed?
- Have we recorded the TRA conclusion and implemented its extra safeguards?
- Is there an owner for monitoring certification, vendors and onward-transfer changes?
Implementation tip
Ask each SaaS supplier for its contracting entity, hosting locations, support locations, current subprocessor list and UK transfer documentation. A UK data-region selection alone does not answer the support-access question.
Apply the limits carefully
The tool produces a review record and action plan. It cannot execute contracts, verify a supplier’s live certification automatically or provide a definitive transfer opinion.
Common misunderstandings
An EU adequacy decision does not automatically establish UK adequacy. Check that the transfer is covered by the current UK regulations, including any limits on countries, sectors, recipients or information.
A covered adequacy route removes the need for an additional Article 46 safeguard and TRA for that transfer. Other duties concerning lawful processing, suppliers, security and accountability continue.
The transitional route for legacy EU SCCs ended in March 2024. The modern EU SCCs require the UK Addendum when used for UK restricted transfers.
A transfer worksheet helps prepare the assessment and contract details. A binding IDTA or Addendum requires the relevant organisations to complete and enter into the agreement.
Worked example: checking overseas support access
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
A fictional business buys a UK-hosted service. A supplier-support walkthrough reveals that a separate overseas group company may access customer records.
- Control
The transfer assessment should account for relevant remote access and the actual recipient organisations.
- Evidence
Obtain the support-access description, entity names, locations, subprocessor list, permissions and contractual documents.
- Finding
The procurement record relies only on the UK server location. It has not assessed the overseas support arrangement.
- Owner and action
The procurement owner and privacy reviewer identify the applicable transfer rules and route, complete any required assessment and obtain the necessary binding terms and operational protections.
- Verification
Compare the final documents and access configuration with the approved arrangement. Add a review trigger for changes to recipients, locations or support access.
Practical questions
What should we ask a supplier about remote access?
Ask which legal entities can access the information, from which countries, for what purposes and under which permissions. Seek evidence that applies to the selected service and configuration, rather than relying on a general hosting statement.
How should we record an unresolved transfer question?
Name the missing evidence, responsible person and decision it prevents. Keep it open until supported; a signed contract does not answer an unresolved question about the actual data flow or operating controls.
Official sources
- ICO: What is an international transfer? (opens in a new tab)
- ICO: Adequacy coverage (opens in a new tab)
- ICO: UK Extension to the EU–US DPF (opens in a new tab)
- ICO: Meeting the transfer rules and data protection test (opens in a new tab)
- ICO: UK IDTA and Addendum (opens in a new tab)
- DUAA commencement regulations: SI 2026/82 (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.