International Data Transfer Mapper
A restricted data transfer is the transfer of personal data from one individual or entity to another individual or entity in another country. In order to be lawful, any restricted data transfer must comply with certain conditions imposed under the GDPR, UK GDPR and/or the Data Protection Act 2018, as applicable.
Where personal data is routed through a third country, even if there is no restricted data transfer or the receiving individual or entity is in a white-listed country, it will still be necessary to establish appropriate technical and organisational security measures which address any additional risk posed by the routing through that third country.