GDPR.ME.UK · WORKING DOCUMENT 73
International transfer decision and TRA worksheet
Follow the actual legal entities and access arrangements, then identify the transfer route and evidence needed. Use the official IDTA or Addendum where appropriate; this worksheet is not a transfer contract.
Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.
Use alongside the international transfers guide and evidence-to-action method.
Record details
1. Apply the restricted-transfer test
- Record whether UK GDPR applies to the processing, whether you initiate a transfer or access outside the UK, and whether the receiver is a separate legal entity.
- Identify remote support and onward access as well as hosting. A UK server does not rule out an overseas transfer.
- Identify the exporter, importer and their roles rather than relying on a product or group brand.
2. Identify the permitted mechanism
- Check current UK adequacy coverage and all limitations. UK–US bridge reliance requires the correct recipient, active UK Extension participation and covered data.
- Where using safeguards, select the relevant route and record the official instrument and completion requirements. EU SCCs alone do not cover UK restricted transfers.
- Treat Article 49 exceptions as specific, condition-dependent routes; do not use them as an unexplained default for routine services.
3. Assess protection and the TRA
- Where relying on appropriate safeguards, assess whether protection after transfer is materially lower than UK protection, acting reasonably and proportionately.
- Record the nature and sensitivity of the information, destination context, enforceability and relevant third-party or government access risks.
- Explain the assessment method, sources, assumptions and uncertainties. If using the ICO tool or government analysis, document its fit to the particular transfer.
4. Specify safeguards and contract actions
- Assign technical and organisational measures such as minimisation, access restriction and encryption where appropriate; describe their effectiveness in this scenario.
- Complete the relevant IDTA/Addendum tables and mandatory terms using the official documents. Record actual execution evidence separately.
- Check Article 28 terms, authorised subprocessors, onward-transfer controls and obligations to notify material changes.
5. Decide whether to proceed
- Record whether the mechanism and safeguards actually cover the transfer. Resolve material gaps before access is enabled.
- Explain residual risks and the reasoned data protection test outcome where required.
- Record approval evidence and conditions; a draft signature field does not establish a binding contract.
6. Monitor changes
- Assign periodic review and event triggers: certification, law, destination, data, service, support or subprocessor changes.
- Keep the mechanism and recipient evidence current. Record escalation if a route no longer covers the transfer.
- Check actual data flows against the approved arrangement.
Sources and completion
- ICO: International transfer test (opens in a new tab)
- ICO: Transfer rules and data protection test (opens in a new tab)
- Official UK IDTA and Addendum documents (opens in a new tab)
Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.
The template does not verify facts, perform an audit, submit a notification or execute a contract.