---
title: "Map each restricted transfer under UK GDPR to adequacy regulations or an appropriate safeguard"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-cross-border-transfer-mechanism-table/united-kingdom"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R10-UK"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["UK"]
last_reviewed: "2026-10-18"
---

# Map each restricted transfer under UK GDPR to adequacy regulations or an appropriate safeguard

> List each data flow, recipient country, vendor and the mechanism relied on (adequacy regulations, the UK IDTA, the Addendum or UK BCRs) from the contracts and the data map.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-cross-border-transfer-mechanism-table/united-kingdom  
Last reviewed: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List each data flow, recipient country, vendor and the mechanism relied on (adequacy regulations, the UK IDTA, the Addendum or UK BCRs) from the contracts and the data map. |
| What the lawyer must review | Confirm each mechanism against the ICO's current international transfers guidance, including the UK Extension for the US. Check where an AI vendor stores and processes data before client data goes in. Do not rely on Australian APP 8 or an EU-only mechanism without the UK Addendum. |
| Written for | United Kingdom (England and Wales) |
| Applies to | [Build a cross-border transfer mechanism table](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-cross-border-transfer-mechanism-table.md) |

## Checking plan

- What the AI does: List each data flow, recipient country, vendor and the mechanism relied on (adequacy regulations, the UK IDTA, the Addendum or UK BCRs) from the contracts and the data map.
- Basis: Checked against the linked sources on 18 October 2026. Confirm the current instrument before reliance.

## Notes

- The ICO's guidance explains when a transfer is a 'restricted transfer' and who is responsible for complying.

## Sources

- [ICO: International transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/) (checked 2026-10-18)
- [SRA: Misuse of AI – warning notice (17 August 2026)](https://www.sra.org.uk/solicitors/guidance/misuse-ai/) (checked 2026-10-18)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*