A company transferred my data outside the UK without safeguards. Is this lawful?

What the Law Says

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) strictly regulate transfers of personal data outside the UK. Such transfers are only lawful if they meet specific conditions — primarily ensuring an adequate level of protection for individuals’ rights.

Under UK GDPR Article 44, any transfer of personal data to a third country or international organisation must comply with Chapter V of the UK GDPR. This means the controller or processor must ensure appropriate safeguards are in place — such as standard contractual clauses (SCCs), binding corporate rules (BCRs), or an adequacy decision by the UK government.

Section 209 of the Data Protection Act 2018 states: 'A transfer of personal data to a third country or international organisation is prohibited unless the transfer satisfies the conditions in Chapter 5 of the UK GDPR.'

The UK Information Commissioner’s Office (ICO) confirms that transfers without safeguards — and without relying on a valid derogation (e.g., explicit consent or necessity for contract performance) — are unlawful and may result in enforcement action.

Statutory Text

A transfer of personal data to a third country or international organisation is prohibited unless the transfer satisfies the conditions in Chapter 5 of the UK GDPR.

— Data Protection Act 2018, s. 209

Sources