Moving personal data to another country, including to a cloud region abroad, needs a legal basis under the exporting country's law. The EU and UK use adequacy findings first and standard clauses second; Saudi Arabia has its own standard clauses; Singapore requires comparable protection; and India currently allows transfers unless the government restricts a destination, with stricter sector rules for payment data. The tool chosen should be recorded per data flow.
EU and UK: adequacy first, then safeguards
Data can flow from the EU without further safeguards to a country with an adequacy decision. The list includes the UK, Japan, Korea and Switzerland, and the United States only for organisations certified under the EU-US Data Privacy Framework. Singapore, India, the UAE and Saudi Arabia are not on it. Transfers elsewhere rely on safeguards such as the Commission's standard contractual clauses or binding corporate rules, which need no prior authorisation from the French regulator; bespoke clauses do.
The UK uses the same order: UK adequacy regulations, then safeguards such as the International Data Transfer Agreement, the Addendum or binding corporate rules, then narrow exceptions. Before relying on a safeguard the exporter must complete a transfer risk assessment showing protection is not materially lower than in the UK.12345
India: open by default, with sector exceptions
Under the DPDP Act, the government may restrict transfers to countries it notifies; no restricted list was confirmed. The Rules allow transfers subject to any government orders on making data available to foreign states, and significant data fiduciaries must keep data categories identified by the government in India. Separately, the Reserve Bank of India requires payment system data to be stored only in India; data processed abroad must be deleted there and returned within one business day or 24 hours.6789
Gulf and Singapore
Saudi controllers using SDAIA's standard contractual clauses, binding common rules or an accreditation certificate are exempt from the adequacy and minimum-data conditions, but must carry out a transfer risk assessment. The UAE federal PDPL allows transfers to destinations approved by the Data Office and in listed cases such as explicit consent. Singapore permits transfers only under prescribed requirements that ensure comparable protection.101112
| Exporting market | Default position | Main tools | Source |
|---|---|---|---|
| EU | Transfer needs adequacy or safeguard | Adequacy (including EU-US DPF), Commission SCCs, BCRs | European Commission; CNIL |
| United Kingdom | Restricted transfer needs a mechanism | UK adequacy regulations, IDTA, Addendum, BCRs; transfer risk assessment for safeguards | ICO |
| India | Permitted unless destination restricted | Government orders; SDF data categories; RBI payment data localisation | India Code; RBI |
| Saudi Arabia | Conditions in PDPL | SDAIA SCCs, binding common rules, accreditation; transfer risk assessment | Secondary sources |
| United Arab Emirates (federal) | Approved or listed cases | Data Office-approved destinations; explicit consent and other cases | UAE Legislation |
| Singapore | Comparable protection required | Mechanisms prescribed in regulations | PDPC |
Decisions to make
- Is the cloud provider's US entity certified under the EU-US Data Privacy Framework?12Certification brings EU transfers to that organisation within the adequacy decision; otherwise SCCs are needed.
- Is the destination adequate for both EU and UK purposes?14Singapore is not on the EU list, so EU data hosted there needs a safeguard.
- Do we process payment data in India or could we be designated a significant data fiduciary?98RBI rules and SDF restrictions can require data to stay in India regardless of the general rule.
- Do we already rely on EU SCCs for Saudi data?10SDAIA's own clauses must be used, and a transfer risk assessment is required.
Documents usually needed
- Data flow map showing exporter, importer and destination for each dataset
- Signed standard contractual clauses, IDTA or Addendum, or SDAIA clauses
- Transfer risk assessments
- Cloud provider DPF certification record and data processing agreement
- Evidence of data localisation for regulated payment data
Common mistakes
- Assuming a US cloud provider is covered by the DPF without checking its certification
- Treating Singapore as adequate under EU law
- Using EU clauses for Saudi transfers
- Overlooking remote access from abroad as a transfer
- Hosting Indian payment data offshore beyond the RBI return window
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- The EU standard contractual clauses decision and EU guidance on transfer impact assessments could not yet be checked.
- The UK extension to the EU-US Data Privacy Framework (UK-US data bridge) was not confirmed on a page opened.
- The prescribed transfer mechanisms in Singapore's Personal Data Protection Regulations could not yet be checked.
- Litigation affecting the EU-US Data Privacy Framework was not reviewed.
- DIFC and ADGM transfer rules are in the UAE market guide and were not repeated.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The European Commission has adopted adequacy decisions for Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (commercial organisations participating in the EU-US Data Privacy Framework), Uruguay and the European Patent Organisation. Singapore, India, the UAE and Saudi Arabia are not on the list. The EU-US Data Privacy Framework decision is dated 10 July 2023; the UK decisions were renewed on 19 December 2025; mutual adequacy with Brazil was adopted in early 2026.
Personal data can flow from the EU to a country covered by a Commission adequacy decision without further safeguards, including US companies certified under the EU-US Data Privacy Framework. Transfers to other countries need GDPR transfer tools.
Reused from market guide claim it-data-003.
Transfers of personal data outside the EEA based on European Commission standard contractual clauses, binding corporate rules, approved codes of conduct or approved certification need no CNIL authorisation; transfers based on bespoke contractual clauses require CNIL authorisation. Applies where no Commission adequacy decision covers the destination. Derogations under GDPR Article 49 are available only in specific situations.
Page notes that the Commission updated its standard contractual clauses on 4 June 2021. Reused from market guide claim fr-data-006.
Under the UK GDPR a restricted transfer must be covered by UK adequacy regulations, or by an appropriate safeguard such as the International Data Transfer Agreement, the International Data Transfer Addendum or binding corporate rules, or else by an exception; if no exception applies, the transfer must not be made. UK GDPR. Exceptions are used only where neither adequacy regulations nor appropriate safeguards cover the transfer.
An exporter relying on an appropriate safeguard must first complete a transfer risk assessment, which the Data (Use and Access) Act frames as a data protection test that protection in the destination is not materially lower than in the UK. UK GDPR. Not needed where UK adequacy regulations or an exception cover the transfer.
The Central Government may by notification restrict the transfer of personal data by a Data Fiduciary for processing to countries or territories outside India that it notifies, and any other Indian law providing a higher degree of protection or restriction on transfers continues to apply. Section 16(1) and (2) of the DPDP Act; commences 13 May 2027. No restricted-country notification was confirmed as at 18 October 2026.
Reused from market guide claim in-data-012.
Under the DPDP Rules 2025, personal data processed by a Data Fiduciary may be transferred outside India subject to requirements the Central Government may set by general or special order on making the data available to a foreign State or its agencies. Central rules; commences with most operational rules on 13 May 2027. No such order was confirmed as issued.
Secondary summary of the Rules; the gazette text could not yet be checked.
The DPDP Rules require significant data fiduciaries to ensure that personal data identified by the Central Government on a committee's recommendation is not transferred outside India. Applies only to entities designated as significant data fiduciaries; commences 13 May 2027 under the current Rules. No identified data categories were confirmed as notified.
Secondary; the PIB backgrounder confirms in general terms that SDFs may have to follow government directions including local storage where needed. Reused from market guide claim in-data-016.
The Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored in systems located only in India; processing abroad is permitted if the data is deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. RBI circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 and FAQs; applies to payment system operators, banks as operators or participants, and their third-party service providers.
FAQ page dated 26 June 2019. Reused from market guide claim in-data-013.
Controllers that transfer personal data abroad using SDAIA's standard contractual clauses, binding common rules or an accreditation certificate are exempt from the PDPL's adequacy and minimum-data transfer conditions, but must carry out a transfer risk assessment. A risk assessment is also required for continuous or widespread transfers of sensitive data. SDAIA publishes the list of jurisdictions it considers adequate and may suspend transfers to a jurisdiction.
Secondary summary of the amended Regulation on Personal Data Transfer outside the Kingdom. Reused from market guide claim sa-data-010.
The PDPL allows personal data to be transferred outside the UAE in cases approved by the Data Office, such as jurisdictions with adequate protection or agreements the UAE has joined, and in other listed cases including the data subject's explicit consent. Federal PDPL; Article 22 (Data Office-approved cases) and Article 23 (other cases).
Reused from market guide claim ae-data-005.
Under the Transfer Limitation Obligation, personal data may be transferred outside Singapore only in accordance with requirements prescribed by regulations, which must ensure a standard of protection comparable to the PDPA, unless the PDPC grants an exemption. The prescribed mechanisms themselves are set out in the Personal Data Protection Regulations, not on this page.
Reused from market guide claim sg-data-003.
Questions on this topic
12 statements on cross-border data transfers
