Data Protection Act 2021 Revision, cross-border transfer of personal data

Data Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 30 September 2019.

A cross border transfer rule binding public and private bodies.

As of 7 September 2026.

What it requires

Do not transfer personal data outside the Islands unless the receiving country or territory ensures an adequate level of protection for data subjects, or a Schedule 4 exception (consent, contractual necessity, or Ombudsman-approved terms) applies.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The eighth data protection principle bars transferring personal data to a country or territory that does not ensure an adequate level of protection for the rights and freedoms of data subjects. Schedule 4 lists transfers to which this principle does not apply, including a transfer with the data subject's consent, one necessary to perform a contract with the data subject, one made on terms the Ombudsman approves as ensuring adequate safeguards, and one the Ombudsman has itself authorised.

When LexLint raises it

crawls_web
trains_models

Read the law

Data Protection Act (2021 Revision), Office of the Ombudsman

Back to the example · Lint your app