The international personal data transfer quagmire

Though we live in the digital age, companies face an ever-increasing regulatory burden when transferring personal data outside of the EU and UK - amid a complex web of differing jurisdictional approaches, compliance gaps and onerous expectations. Miriam Everett explores the legal challenges.

Miriam Everett is a partner and global head of Data and Privacy who has over 15 years' experience in advising clients on complex issues regarding the highly-regulated area of data. Contact her on miriam.everett@hsf.com.

Restrictions on the international transfer of personal data are not new. Although they have hit the headlines a few times in recent years, largely as a result of complaints about the large-scale transfer of personal data from the European Union to social media and/or technology companies in the United States, there has been a regulatory restriction on the transfer of personal data outside of the EU (including the United Kingdom) since the 1995 EU Data Protection Directive. That same restriction exists today contained within the text of the General Data Protection Regulation and also the UK GDPR, which has been in place since Brexit.