Principal 8

8. Personal data shall not be transferred to a country or territory outside the European Economic Area.

Countries within the European Economic Area (EEA) are considered to have adequate legal protection in place to deal with personal data. You may transfer personal data to countries within the EEA on the same basis as you may transfer it within the UK.

However, you may only send personal data to a country or territory outside the EEA if that country or territory ensures an adequate level of protection for the rights and freedoms of individuals in relation to processing personal data.

You can find details of countries’ adequacy levels on the EU website:http://ec.europa.eu/justice/data-protection/ and more details of transferring data outside of the EEA are covered later in this course.