CyberFreezeDev- Home
- Blog
- Industry guides
- UK GDPR and transfers to India: IDTA, Addendum and TRA
UK GDPR and transfers to India: IDTA, Addendum and TRA
India is not covered by UK adequacy regulations, so personal data sent to or accessed from India needs a safeguard such as the IDTA and a transfer risk assessment. Here is how that works with an AI developer, and how to avoid the transfer altogether.
India does not have UK adequacy regulations, so if personal data is sent to, or accessed from, a developer in India, that is a restricted transfer under UK GDPR. You need an appropriate safeguard, usually the ICO's International Data Transfer Agreement (IDTA) or its Addendum to the EU standard contractual clauses, plus a transfer risk assessment. If the developer never receives or sees personal data, for example because they build on anonymised or synthetic data and the live system runs in the UK, no restricted transfer takes place.
This is general information, not legal advice. Your DPO or lawyer makes the call for your organisation.
Is India covered by UK adequacy regulations?
No. The ICO lists the countries covered by UK adequacy regulations: the EEA states, Andorra, Argentina, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay and the Republic of Korea, with partial coverage for Canada, Japan and the United States. India is not on the list as of 27 October 2026.
That leaves two routes for transfers to India: an appropriate safeguard, or one of the narrow exceptions in Article 49. The ICO says you generally need to show that relying on an exception is necessary and proportionate, so for a development contract that runs for months, a safeguard is the usual route.
When does working with an Indian developer count as a transfer?
The ICO uses a three step test:
- Does the UK GDPR apply to your processing of the personal information?
- Are you initiating the transfer to an organisation located outside the UK?
- Is the receiving organisation a separate legal entity from you?
A developer in India passes steps 2 and 3 on its own. The ICO also makes clear that "transfer" covers making information accessible, not only sending it. Its own example is a UK business that lets an organisation in India access customer records on its systems: no file is sent, and it is still a restricted transfer.
Two practical consequences follow. A developer with a login to your production CRM is receiving a transfer even if nothing is downloaded. Your own employee opening UK systems on a work laptop while abroad is not, according to the ICO's FAQs, because no separate organisation is involved.
IDTA or Addendum: which one?
The ICO says you can choose either.
| IDTA | Addendum | |
|---|---|---|
| What it is | A standalone UK agreement | An addendum to the EU standard contractual clauses of 4 June 2021 |
| Suits | UK only organisations | Organisations already using the EU SCCs for EEA data, though UK only firms may use it too |
| Changes allowed | Minor amendments only, nothing that reduces protection | Minor amendments only, as the Addendum sets out |
| TRA needed | Yes | Yes |
The EU SCCs are not valid on their own for UK transfers; the ICO is explicit about that. The ICO plans to update both the IDTA and the Addendum during 2026, and says to keep using the current versions until then. Either one sits beside, not instead of, the Article 28 processor contract you need with any developer handling personal data for you.
What the transfer risk assessment checks, and what DUAA changed
The ICO describes a TRA as checking that people's protection is not materially lower after the transfer. You only need one when you rely on a safeguard such as the IDTA. In practice the inputs for a development engagement are short: which categories of data, who at the developer can access them, from where, under what security controls, and for how long.
The Data (Use and Access) Act 2025 changed the wording. According to the ICO's updated guidance of 15 January 2026:
- New name. A TRA is now referred to in UK legislation as a "data protection test".
- Same idea. You must decide, acting reasonably and proportionately, that the standard of protection is not materially lower. The ICO notes it used to call this standard "sufficiently similar".
- Old TRAs still count. A TRA completed under the earlier guidance, which concluded protection was sufficient, meets the data protection test.
- Documents to follow. The IDTA and Addendum will be updated during 2026, and the ICO's anonymisation guidance is under review because of the Act.
The ICO still publishes its TRA tool, which works through the questions step by step.
When no restricted transfer happens at all
Often the cleanest answer for an AI build is to design the transfer out:
- Anonymised data. The ICO says data protection law does not apply to anonymous information. The ICO's test is whether any means of identifying people are reasonably likely to be used, by you or anyone else, so stripping names alone is not enough.
- Pseudonymised data is not a way out. Replacing names with reference numbers is useful security, but the ICO says pseudonymous information is still personal data.
- Synthetic data. Generated records that mimic the shape of yours let a developer build and test without seeing a real customer.
- Deploy in the UK. The production system runs in your own UK cloud account or on your server. If the AI must read personal data, an open-weight model there means prompts are not sent to a model provider abroad; see private AI deployment.
- Plan for support. If our engineers later need production access to fix something, that access is a transfer. Agree the IDTA or Addendum before go-live, not during an incident.
India's own data law, the DPDP Act 2023, sits alongside your UK GDPR duties and does not replace them.
How we handle it
Where we process personal data for a UK client, we sign the client's processor contract and add the IDTA or Addendum when data reaches India. Where we can avoid that, we build on anonymised or synthetic samples and deploy into the client's UK accounts. Our United Kingdom page sets out the working pattern, time overlap and contracting entity.
If your DPO has questions about a specific build, bring them to the first call. Book a consultation.
