The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Can I send personal data overseas?

You may transfer personal data to countries within the European Economic Area (EEA) on the same basis you transfer data within the UK.  However, you can only send personal data to a country or territory outside the EEA if that country or territory ensures an adequate level of protection for the rights and freedoms of individuals when processing their personal data.
Before transferring personal data outside the EEA you should ask yourself the following ten questions which will guide you through the ICO’s approach to compliance with the restriction on international data transfers contained in the eighth data protection principle:

1. Do you need to transfer personal data abroad?

2. Are you transferring the data to a country outside the EEA or will it just be in transit through a non-EEA country?

3. Have you complied with all the other data protection principles?

4. Is the transfer to a country outside the EEA?

5. Is the transfer to a country on the EU Commission’s list of countries or territories providing adequate protection for the rights and freedoms of data subjects in connection with the processing of their personal data?

6. If the transfer is to the United States of America, has the US recipient of the data signed up to the US Department of Commerce Safe Harbor Scheme? 

7. Is the personal data passenger name record information (PNR)?

If you decide you need to transfer personal data outside the EEA, and the recipient is not in a country subject to a Commission ‘positive finding of adequacy’ nor signed up to the Safe Harbor Scheme, you will need to assess whether the proposed transfer will provide an adequate level of protection for the rights of the data subjects in connection with the transfer/processing of their personal data.

8. Can you make an assessment that the level of protection for data subjects’ rights is ‘adequate in all the circumstances of the case’? 

9. If not, can you put in place adequate safeguards to protect the rights of the data subjects whose data is to be transferred?

10. Can you rely on another exception from the restriction on international transfers of personal data? 

For help in answering these questions and for more about transferring personal data overseas see our Guide to Data Protection.

We have also produced specific guidance: