Internal, open access

Transfer of personal data beyond the EEA

Transfer of personal data to countries outside the European Economic Area (EEA), which comprises the European Union (EU) plus Norway, Iceland and Liechtenstein, is prohibited under the Act unless certain criteria are met.

The following transfers are allowed:

  • requests to non-EEA governments, agencies, and organisations for information necessary to determine academic eligibility for attending a course of study in the UK
  • transfers of personal data to non-EEA governments, agencies, and organisations sponsoring students to attend a course of study in the UK, where such sponsorship is dependent upon attendance and/or performance criteria. In these cases the student's consent to the transfer should be confirmed on entry to the University
  • transfers of personal information (e.g. examination marks), relating to, and required by, data subjects engaged in distance learning courses

Other transfers can sometimes be permitted but only with the informed and explicit consent, usually in writing, of the data subject concerned. Informed consent would be dependent on the University making the data subject aware of any risks that the University may have assessed as being involved in the transfer.

If a student requests a reference be written and sent to a non-EEA country, the request itself will indicate their consent to the personal data transfer.

Further details and advice can be found on the website of the Office of the Information Commissioner in the section on overseas transfers.

Things to do now

Contact IMPS

Page navigation


Search Form

A-Z lists