The Eighth Data Protection Principle and International Data Transfers (EU)


Key Questions: How do I prepare for an international data transfer? What do I need to consider before transferring data?

This guidance considers the provisions of the eighth data protection principle (the eighth principle) of the DPA relating to international transfers of personal data made by a data controller based in the UK to recipients based outside the European Economic Area. In addition, before making a transfer of personal data, a data controller should consider whether it is possible for it to achieve its objectives without processing personal data at all and examine options such as the anonymisation of such data. If the data does not relate to identifiable individuals then this brings such data outside the scope of the DPA and means that any transfer could be made freely and without reference to the eighth principle.


  • Introduction
  • More information
  • Overview
  • Step 1 – Will there be a transfer of personal data to a third country?
  • Step 2 – Does the third country and the circumstances of the transfer ensure an adequate level of protection?
  • Step 3 – Have or can the parties put into place adequate safeguards?
  • Step 4 – Do any other derogations to the eighth principle apply?
  • Section 5 – International outsourcing to data processors located in a third country
Contact Person/Organization: 

Information Commissioner's Office (ico.)

Type of Tool:

Publication Date: