Buyer Guides · 7 MIN
UK GDPR and transferring data to India: the legal route, step by step
How a UK company can lawfully let an India-based software team access personal data: IDTA or Addendum, risk assessment, and the new protection test.
A UK company can let an India-based software team access personal data, but it needs a lawful transfer route. India is not among the countries covered by UK adequacy regulations as far as the ICO's published information shows, so most companies use the ICO's IDTA or the UK Addendum, plus a transfer risk assessment. This guide sets out the steps.
- A restricted transfer happens when you send personal data to, or make it accessible to, a separate organization outside the UK.
- Without adequacy regulations, you need an appropriate safeguard such as the IDTA or the Addendum to the EU SCCs, or a narrow exception.
- Since the Data (Use and Access) Act 2025, the test is that protection after transfer is "not materially lower" than in the UK, applied reasonably and proportionately.
- You still need an Article 28 processor contract, which is separate from the transfer mechanism.
- Design choices such as synthetic data and UK-region hosting can remove many transfers entirely.
- Nactore is an AI-native technology and growth company in Mumbai and works with UK clients on the data terms their counsel sets.
This guide explains how the rules work. It is not legal advice, so confirm your approach with UK counsel or your data protection officer.
When does UK GDPR treat a transfer to India as restricted?
The ICO defines a restricted transfer as sending personal information to, or making it accessible to, a separate organization outside the UK when the UK GDPR applies to your processing. Read the ICO's brief guide to international transfers.
The words "made accessible" matter. An engineer in Mumbai who views production records through a remote session has received access, even if the data never leaves a UK server. Plan for access, not only for file transfers.
A separate vendor company is the usual case for software work, and the case this guide covers.
Is India covered by UK adequacy regulations?
UK adequacy regulations list the countries and territories the UK government has found to have adequate protection. The government's list includes the EU and EEA states, New Zealand, the Republic of Korea, Japan and Canada (both partial), and the United States only under its Data Privacy Framework. India is not on it. See the government's explanation of the UK approach to international data transfers.
Check the current list on the ICO's adequacy regulations pages before you rely on this, because the list can change.
Which transfer mechanism should you use?
The ICO's two sets of standard data protection clauses are the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum. Its page on the IDTA and the Addendum explains the difference.
| Option | Best for | Notes |
|---|---|---|
| IDTA | A UK-only data flow to a vendor in India | A standalone ICO agreement. Parts 1 to 3 are flexible, and only minor changes are allowed to the mandatory clauses in Part 4 |
| UK Addendum | A company that also uses the EU SCCs for European data | Added to the EU SCCs, with only minor amendments allowed |
| Binding corporate rules | Groups with companies in several countries | Heavier to set up, suited to large groups |
| Article 49 exception | One-off, narrow cases | Not designed for ongoing vendor work |
For a software vendor relationship, the IDTA or the Addendum is the realistic choice.
What is a transfer risk assessment and what is the new test?
When you rely on appropriate safeguards, you must also assess whether the protection holds up in practice. The ICO calls this a transfer risk assessment, or TRA, and publishes a transfer risk assessment guide and tool.
The Data (Use and Access) Act 2025 reframed the standard as a data protection test. Under Schedule 7 of the Act, in force since 5 February 2026, the controller or processor, acting reasonably and proportionately, must consider that the standard of protection after the transfer would be "not materially lower" than the protection under UK law.
A useful TRA for a software vendor covers these points.
- What data, and how sensitive. Fields, volumes, and whether special category data is involved.
- Who gets access. Named roles, not "the team."
- Technical controls. Encryption, access logging, device rules, and masking.
- Local legal access. Whether public authorities in the destination country can compel access, and the vendor's process if they try.
- Residual risk and decision. A written conclusion, reviewed when the facts change.
Who is the exporter, and what is the vendor's role?
If your vendor acts only on your instructions, it is your processor and you are the controller. The ICO says the transfer rules apply to the organisation initiating the transfer, and that if you initiate a restricted transfer, you are responsible for complying with the transfer rules. When you send data to, or open access for, a vendor in India, that is you. In plain terms, the legal duty to pick a route and run the TRA sits with you, so do not assume the vendor has handled it.
A good vendor still helps. It should supply the facts for the TRA, sign the IDTA or Addendum, and flag any change in its setup.
What goes in the processor contract?
The transfer clauses sit next to, not instead of, the Article 28 contract. The ICO's page on what needs to be included in the contract lists the minimum. Among them are processing only on documented instructions (including for transfers), confidentiality, security measures, sub-processor controls, help with individual rights, deletion or return at the end, and audit rights.
Check sub-processors with particular care in AI work. A model provider that receives prompts containing personal data is a sub-processor, and the transfer chain extends to it.
How can you reduce the transfer in the first place?
You can often shrink the problem before you paper it.
- Use synthetic or masked data for development and testing.
- Keep production data in a UK or EEA region and limit remote access to named, logged roles.
- Minimize fields so the vendor sees only what the task needs.
- Separate duties, so engineers can fix code without reading customer records.
Each step lowers risk and makes the TRA simpler to write. See also IP and data terms for AI projects.
Write the TRA before you sign the vendor, not after the first sprint. If the conclusion is "not materially lower only if we mask the data," you want to know that while the design is still cheap to change.
Frequently asked questions
Is a UK to India data transfer legal?
Yes, with the right route. Without adequacy regulations, you use appropriate safeguards such as the IDTA or the Addendum, complete a transfer risk assessment, and keep an Article 28 contract in place.
Do I need the IDTA if I already use the EU SCCs?
You can use the UK Addendum instead, which attaches to the EU SCCs. The ICO says this appeals to organizations that already use the SCCs for European data.
Does remote access from India count as a transfer?
Yes. The ICO's definition includes making personal information accessible to a separate organization outside the UK, so remote viewing counts.
Who is responsible if the vendor is the one in India?
Generally the controller, which is you, because you initiate the transfer. The vendor must support you, and your contract should require it to.
Pick the route, document the decision
A lawful UK to India arrangement rests on three documents: the Article 28 contract, the IDTA or Addendum, and a written transfer risk assessment. Combine them with good design, and the legal path is clear.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.