Context
The ICO has announced that its new interactive self-service tool to help firms decide if they are making a restricted transfer under UK GDPR is now live. The self-service tool will provide customised guidance on how the legislation is likely to apply to firms’ specific transfer scenarios. The ICO uses ‘transfer’ in this tool to refer to both sending personal information to a separate organisation outside the UK, and making personal information accessible to a separate organisation outside the UK.
Key points to note
The tool is based on a three‑part test which helps firms work out whether their situation counts as a restricted transfer, including:
- whether the UK GDPR applies to the information;
- whether you are sending it to an organisation outside the UK; and
- whether that organisation is a separate legal entity.
There are up to six questions to answer, and the process takes about ten minutes. Although the results of the tool are not definitive (the ICO stresses that it is still a firm’s responsibility to make sure its processing complies with UK data protection law), it provides a reliable indication of how the legislation is likely to apply.