It is possible to make a restricted transfer if the receiver is in a third country or territory, or is an international organisation, covered by UK adequacy regulations.
‘Adequacy’ is a status granted by the UK to countries which provide high standards of protection for personal data. An adequacy determination means that personal data can be transferred from the UK to that country freely, in accordance with the terms of the relevant adequacy decision.
UK ‘adequacy’ regulations cover the EEA and all countries, territories and international organisations covered by European Commission adequacy decisions valid as at 31 December 2020. The UK intends to review these adequacy regulations over time and further countries may be deemed to have adequate protections by the Secretary of State.