By the Renewminder Talent team · Updated 20 October 2026
Under UK GDPR, giving a separate organisation outside the UK access to personal data, for example a support provider abroad reading your customer emails, is a restricted transfer, even if the data never leaves your systems. It must be covered by UK adequacy regulations for that country, an appropriate safeguard such as the International Data Transfer Agreement (IDTA) or the UK Addendum, with a transfer risk assessment, or a narrow exception. Morocco isn't on the UK adequacy list, so transfers there need a safeguard.
What counts as a restricted transfer
The ICO describes a restricted transfer as sending personal information to, or making it accessible to, a separate organisation located outside the UK. Its own example is a UK business giving an organisation in India access to personal information on its systems: that's a restricted transfer. The rules apply even to small or occasional transfers.
Three ways to make it lawful
- Adequacy regulations. The country is on the UK's adequacy list. No extra safeguard is needed, though you should still check who you share with.
- Appropriate safeguards. For example the IDTA, the UK Addendum to the EU standard contractual clauses, or binding corporate rules. Both sides must be legally required to protect the data, and you must complete a transfer risk assessment.
- Exceptions. Narrow exceptions under Article 49. If none applies and there's no adequacy or safeguard, the transfer can't go ahead.
Which countries have UK adequacy
From the ICO's list.
The EEA countries, plus Andorra, Argentina, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, the Republic of Korea, Switzerland and Uruguay, with partial adequacy for Canada, Japan and the United States. Countries not on the list, such as Morocco, India or the Philippines, need a safeguard or an exception. The ICO keeps the list up to date, so check it.
Transfer risk assessments
When you rely on a safeguard like the IDTA, you complete a transfer risk assessment to make sure the protection for people's information isn't materially lower after the transfer.
What to ask any overseas provider
- Who exactly will access our data, and from which countries?
- Which safeguard covers the transfer, and can we see it?
- Will you sign a data processing agreement?
- What security do your staff use: their own logins, two-step sign-in, removable access?
- What do you do with our data when we stop?
Renewminder signs a data processing agreement with every client before an assistant starts, and each assistant gets their own login with two-step sign-in, which you can remove at any time.
Sources
Checked 20 October 2026. Rules change, so check the source before you rely on it.
Quick answers
Is a remote assistant abroad reading my emails a data transfer?
If they work for a separate organisation outside the UK, yes. The ICO says making personal information accessible to a separate organisation abroad is a restricted transfer.
Does Morocco have UK adequacy?
No. Morocco isn't on the UK adequacy list, so a transfer there needs an appropriate safeguard, such as the IDTA, or an exception.
What is the IDTA?
The International Data Transfer Agreement: a set of standard clauses the UK uses as a safeguard for restricted transfers. The UK Addendum to the EU standard contractual clauses does the same job.
What is a transfer risk assessment?
A check you complete when you rely on a safeguard, to make sure people's information isn't materially less protected after the transfer.