Map the first, then use Article 45A approval regulations, an Article 46 safeguard with the required , or a specific Article 49 derogation.
Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.
Use this workflow for a where a UK GDPR controller or processor makes personal data accessible to a separate organisation outside the UK. Map exporter, importer, roles, destination, onward access and transfer direction; then apply Article 44A in order: approval regulations under Article 45A, an Article 46 safeguard, or a specific Article 49 derogation, subject to any Article 49A restriction.
Confirm that UK GDPR-covered processing sends or makes personal data accessible to a separate recipient in a third country or international organisation. Map remote access, cloud hosting, support, group-company disclosure, processor and subprocessor chains, and onward transfers. A transfer within the same legal entity may fall outside this definition, but the overseas processing still needs UK GDPR security and accountability controls.
Do not classify a flow from geography alone. A UK employee remotely viewing data on the same UK controller's overseas system may remain an internal movement, while support access by a separate overseas vendor can be a even when no file is downloaded. A disclosure to another company in the same group is still between separate legal persons and can be restricted.
Apply Article 44A in order. First check whether current Article 45A approval regulations cover the destination, recipient, data, and transfer. An approval can be limited: for example, the UK-US data bridge covers eligible US organisations participating in the UK Extension to the EU-US Data Privacy Framework, not every US recipient. Keep evidence of current participation and that the data falls within scope.
If approval regulations do not cover the flow, use an Article 46 safeguard and complete the required . If neither route applies, use Article 49 only where the facts meet a listed specific situation and no Article 49A restriction blocks the transfer. Consent must be explicit and informed of transfer risks; contract and public-interest routes have necessity tests; and the compelling-legitimate-interests route has additional limits and notification requirements. A derogation is not a standing vendor-transfer mechanism merely because the transfer is convenient.
Sources (3)
GOV.UK manual guidance for recording adequacy-assessment information that can inform international-transfer governance records.
Binding source for the restricted-transfer route order, approval regulations, safeguards, Article 46 data protection test, derogations, and public-interest restrictions.
GOV.UK source for the UK transfer toolkit, adequacy approach, and policy context behind transfer-workflow records.
The record must connect the actual data flow to one lawful Chapter V route. A contract name alone is not enough: show the parties and signatures, covered transfers, assessment, measures, operating evidence, assumptions, and review owner.
Sources (3)
Binding source for the fields needed to establish the transfer route and document Article 46 or Article 49 decisions.
GOV.UK source for the UK transfer toolkit, adequacy approach, and policy context behind transfer-workflow records.
GOV.UK explainer for documenting UK-US data bridge eligibility and protection-level assumptions in transfer workflows.
Review when approval regulations, recipient eligibility, the chosen safeguard, destination law or practice, importer ownership, subprocessor chain, data categories, volume, purpose, access method, security, or evidence changes. A fixed review date does not replace event-driven monitoring.
Sources (4)
GOV.UK manual guidance for recording adequacy-assessment information that can inform international-transfer governance records.
Binding source for checking whether the approved route and Article 46 data protection test remain satisfied after a material change.
GOV.UK source for the UK transfer toolkit, adequacy approach, and policy context behind transfer-workflow records.
GOV.UK explainer for documenting UK-US data bridge eligibility and protection-level assumptions in transfer workflows.
Assign transfer mapping, route selection, protection assessment, measures, approval, and monitoring evidence.
Create scoped transfer questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.