United KingdomUK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United Kingdom
UK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025
In force since , effective .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Before moving personal data of a person in the United Kingdom outside the UK, either rely on a UK adequacy regulation, put appropriate safeguards in place such as the ICO's International Data Transfer Agreement or Addendum, or rely on a narrow Article 49 derogation, under UK General Data Protection Regulation (GDPR) Article 44A.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Art. 83(5)(c) puts an infringement of the transfer restrictions in Articles 44A to 49 under the higher maximum amount: the higher of £17,500,000 or 4% of worldwide annual turnover (DPA 2018 s.157(5)).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority
- Open questions
- Do any regulations under Article 49A currently restrict a transfer made subject to appropriate safeguards, or in reliance on a derogation, to a given destination?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 49(6) requires a controller or processor that transfers on the compelling legitimate interests derogation to document its assessment and the safeguards it supplied in its Article 30 records. The documented items are outside the closed list of log contents. Article 47(2)(j) separately makes data protection audits a required part of binding corporate rules and says the results should be available to the Commission on request; that is the only audit language in the range. Article 30(4), which the records of Article 49(6) fall under, is not cited by this row.
- Kind
- Explicit
- As of
- Provision
- UK GDPR Article 49(6)
- Trigger
- personal_data_processing
Why the legislator wanted it
- As of
- Quote
- Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.
- Source link
- https://www.legislation.gov.uk/eur/2016/679/introduction
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
What this law does
The European Commission's own adequacy decisions for the UK were renewed and now run to . For UK-outbound transfers, the International Data Transfer Agreement (IDTA) and the IDTA Addendum, both issued by the ICO, are standard data protection clauses a transfer can rely on as its appropriate safeguard where no UK adequacy regulation covers the destination. The Information Commission took over the Information Commissioner's functions on .
The DUA Act restructured UK GDPR's transfer chapter: the original Article 44 was omitted and replaced from by a new Article 44A, which requires that a transfer either be approved by regulations, made subject to appropriate safeguards, or made in reliance on a derogation for specific situations, the same three-track adequacy, safeguards, or derogation structure as EU GDPR Chapter V, run through the UK's own instruments rather than the EU's. This is a real, structured condition on outbound transfer, not an absence of restriction.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .