What is a restricted or cross-border transfer?

It is any transfer of personal data to a recipient outside the EEA (for GDPR) or outside the UK (for UK GDPR), including remote access from abroad. Chapter V of the GDPR requires a lawful transfer mechanism for every such transfer.

When can I rely on an adequacy decision?

When the destination has been formally recognised by the EU Commission or the UK as providing essentially equivalent protection. Adequacy means you can transfer freely with no extra safeguard, though you should keep monitoring that the decision remains in force.

What is the difference between SCCs and the IDTA?

Standard Contractual Clauses are the EU's modular 2021 contract for transfers out of the EEA. The UK uses its own International Data Transfer Agreement (IDTA) or a UK Addendum bolted onto the EU SCCs. Both require a transfer risk assessment of the destination.

When can I use an Article 49 derogation?

Derogations such as explicit consent or contractual necessity are a last resort for occasional, non-repetitive transfers of limited data. They cannot be used for routine or large-scale flows, where SCCs, the IDTA, or BCRs are required instead.

Does this replace legal advice?

No. It uses a simplified adequacy list and standard decision logic to point you to the likely mechanism. Adequacy decisions and surveillance assessments change frequently, so confirm with current ICO and EU guidance and take professional advice.

What is the Data Transfer Mechanism Selector (GDPR / UK GDPR)?

Answer questions about the exporter regime, recipient country, group relationship, and transfer frequency to select the appropriate cross-border mechanism: adequacy decision, SCCs, the UK IDTA, Binding Corporate Rules, or an Article 49 derogation. It runs free in your browser on Gera Tools, with nothing uploaded.

Data Transfer Mechanism Selector (GDPR / UK GDPR)

Name: Data Transfer Mechanism Selector (GDPR / UK GDPR)
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Moving personal data across borders under the GDPR or UK GDPR means picking a lawful transfer mechanism from Chapter V. This selector walks the decision tree the way a data protection officer would — adequacy first, then contracts, then narrow derogations — and tells you the exact article that applies.

How it works

Chapter V sets a priority order for cross-border transfers:

Adequacy (Art. 45) — if the destination has an adequacy decision, you can transfer freely with no extra safeguard.
Appropriate safeguards (Art. 46) — otherwise use a contract: EU Standard Contractual Clauses for an EU exporter, or the IDTA / UK Addendum for a UK exporter, paired with a transfer risk assessment.
Binding Corporate Rules (Art. 47) — for intra-group transfers in large multinationals, once approved by a supervisory authority.
Derogations (Art. 49) — explicit consent or contractual necessity, only for occasional, limited transfers.

The tool applies these in order based on your answers, including the special case of certified US recipients under the Data Privacy Framework.

EU versus UK: two regimes, different tools

The EU and UK have diverged since Brexit. An EU exporter sending data to the US must use the 2021 EU Standard Contractual Clauses (which replaced the old 2010 SCCs). A UK exporter sending the same data must use either the UK International Data Transfer Agreement (IDTA) or the old EU SCCs supplemented by the UK Addendum — the EU SCCs alone are not sufficient for a UK-to-third-country transfer.

If you are a multinational with both an EU entity and a UK entity transferring to the same US vendor, you may need both: EU SCCs for the EU leg and the IDTA for the UK leg. The selector distinguishes these regimes based on which data-protection law governs the exporter.

The Data Privacy Framework special case

US recipients that are certified under the EU-US Data Privacy Framework (DPF) benefit from an adequacy-equivalent status for EU transfers — no SCCs needed, provided the recipient’s certification is active. This does not apply to UK transfers; the UK has its own adequacy decision for the US that operates on different terms.

Always verify DPF certification at the official DPF list before relying on it, since certification can lapse.

Worked examples

Example 1 — Routine analytics to a non-DPF US vendor (EU exporter): Adequacy does not cover the US generally. The appropriate mechanism is the EU SCCs, module 2 (controller to processor), combined with a Transfer Impact Assessment documenting supplementary measures such as encryption and pseudonymisation.

Example 2 — Same flow from a UK subsidiary: Use the IDTA or the EU SCCs with the UK Addendum. A Transfer Risk Assessment is still required.

Example 3 — One-time employee relocation data sent to a non-adequate country: An Article 49(b) derogation may apply if the transfer is necessary to perform a contract with the data subject. Document the necessity and keep it as a genuine exception, not a workaround for routine flows.

Example 4 — Intra-group HR data across 20 countries (large multinational): Binding Corporate Rules, once approved, cover all the group entities listed. The approval process is long (typically 12–24 months) but removes the need to execute SCCs with every internal entity.

Transfer Risk Assessment: the step people skip

Both the EU SCCs and the UK IDTA require a documented Transfer Impact Assessment (TIA) or Transfer Risk Assessment (TRA) evaluating whether the destination country’s laws allow the contractual protections to work in practice. This is not optional. Supervisory authorities have enforced this requirement, and contracts alone are insufficient without the assessment. The selector flags when a TIA/TRA is required alongside the chosen mechanism.