International transfer guidance – webinar

Time: 10:00am to 11:00am UK time. 

We are hosting a DPPC+ webinar supporting the launch of our updated international transfers guidance.  DPPC+ events are smaller, shorter and more targeted to a specific sector or level of experience than our annual flagship conference Data Protection Practitioners' Conference.

This webinar will be aimed at organisations from public and private sectors which transfer, or advise their clients on transferring, personal information outside the UK. We encourage SMEs and organisations with less experience of making international transfers to attend, as well as more experienced data protection professionals.  

Attendees can expect an overview of how we’ve updated and extended our guidance on international transfers. We’ll talk about what we heard from stakeholders in our call for views last summer, and how we’ve reflected this feedback in our new guidance.  

There will be an opportunity to submit your questions before the webinar.

What is the guidance about:   

This guidance will help you develop your understanding of  the rules on transferring personal information to other countries under UK GDPR – when the rules about transferring information to other countries apply, how to make what we call a 'restricted transfer', and who has responsibility for complying with the rules.  

Before attending this webinar, you may find it helpful to watch the following videos.  

An introduction to international transfers part one: What is a transfer?   

In Part 1 we’ll help you understand what a ‘restricted transfer’? is. We’ll answer some common questions and explore who is responsible for complying with the transfer rules. We’ll use scenarios to add context.  

NB. In this video, step 2 of our ‘three step test’ on restricted transfers is about whether you’re transferring information outside of the UK. We consider who’s responsible for complying with the rules on restricted transfers separately.  In our new guidance, we’ve streamlined our thinking and the focus of step 2 is on identifying who’s initiating the transfer of information to an organisation outside the UK (rather than who’s transferring it). If you’re not initiating the transfer, then it’s not a restricted transfer for your organisation. 

Approx running time: 18 minutes 

An introduction to international transfers part two: How to make a transfer  

Watch part one first.  

In part two, we’ll look at how to make restricted transfers in a compliant manner. You’ll need to ensure your transfer is covered by adequacy regulations, appropriate safeguards, or an exception. We’ll reflect on the scenarios outlined in part one.  

NB. In this video we explain that before you use the UK Extension to the EU-US DPF to make a restricted transfer to the US, you need to check that the organisation you’re sending to has active status on the DPF. It must also specifically be signed up to the UK Extension as part its registration. 

We talk about the ‘vital interests’ exception to the rules on restricted transfers and indicate that it should only be used in ‘life and death’ type situations. In our guidance we use a broader interpretation: vital interests covers the situation when someone’s life, or their physical or mental health or wellbeing is at urgent and serious risk. This includes an urgent need for life-sustaining food, water, clothing or shelter. 

Approx running time: 10 minutes 

Presenters: 
Emma Ashworth, Group Manager International, Regulatory Strategy
Kitty Rosser Principal Lawyer, Legal Service, Policy and Commercial