Transfer of Personal Data - Outwith the EU

The 8th Principle of the DPA forbids the transfer of personal, and sensitive personal, data outwith the European Economic Area unless specific conditions are met:

• The transfer is consistent with the University's notification with the Information Commissioner, and
  the explicit consent of the individual is obtained; and
• an appropriate contract is in place between the University and the recipient of the personal data, specifying the data protection requirements that must both be observed and subject to audit by the University.

It is essential to consult with the University's Data Protection Officer where the international transfer of personal data is being considered. The European Economic Area is currently defined as the European Union [EU], plus Iceland, Norway and Liechtenstein.