Deal data hosted outside the UK: adequacy, the IDTA and what to ask your provider

Most UK deal teams only think about hosting when a buyer’s general counsel asks. By then the room is full. The better moment is the shortlist: two or three written answers from each provider, filed with the deal records, settle the question before a single employee contract is uploaded.

This guide covers the mechanics of a cross-border transfer under UK law, what each mechanism involves, and the questions that get a straight answer from a data room provider.

When does a data room create a restricted transfer?

A restricted transfer happens when personal data subject to UK GDPR is sent to, or made accessible from, a country outside the UK, and the recipient is a separate organisation. A data room provider acting as your processor counts, and so do its sub-processors.

Three points trip people up.

It is about personal data, not all data. Board minutes, management accounts and contracts usually contain some personal data (names, signatures, salaries), so in practice almost every room holds some. The transfer rules apply to that part.

Access is a transfer. If files sit on a server in London but an engineer in another country can open them to fix a problem, personal data is being made available outside the UK. Ask about support and administrator access as well as storage.

Backups and replicas count. A provider may keep primary storage in one region and backups, disaster recovery copies or search indexes in another. Each location is a destination.

The legal framework is in Chapter V of the UK GDPR, read with the Data Protection Act 2018. The ICO’s guidance on international transfers is the practical reference, and it is worth reading the short section on what is and is not a restricted transfer before you go further.

Which destinations are covered by UK adequacy regulations?

Where the UK government has made adequacy regulations for a country, personal data can flow there as freely as within the UK. No IDTA or risk assessment is needed for that leg, though you still need your processor contract.

The list changes as the government adds countries and reviews existing decisions, and the Data (Use and Access) Act 2025 amends the transfer test that future adequacy decisions use. Check the current position on the ICO or gov.uk before relying on this table for a specific country.

What is the difference between the IDTA and the UK Addendum?

Both are standard contracts approved for UK transfers. Which one a provider offers usually depends on whether it already uses the EU’s standard contractual clauses for European customers.

Contracts that still rely on the old EU clauses without the UK Addendum are out of date for UK transfers; the transition period for those ended in March 2024. If a provider’s paperwork predates 2022, ask for the current version.

Large groups sometimes rely on binding corporate rules for transfers within the group. That helps with transfers between a provider’s own entities but does not replace a contract between you and the provider.

What does a transfer risk assessment involve?

Before relying on the IDTA or the Addendum, the exporter (you, as controller, or the provider on your behalf for onward transfers) has to assess whether the contract will actually protect the data in the destination country. The concern is mainly whether local law lets public authorities access the data in ways that undermine UK protections.

For a deal room, the assessment is usually short and proportionate. The questions are what personal data is in the room, how sensitive it is, how long it will be there, who at the provider can access it in clear text, and whether there is any realistic prospect of local authorities seeking it. Encryption with keys held under tight control, short retention and minimised content all reduce the risk.

The ICO publishes a transfer risk assessment tool that walks through the steps. Many providers prepare their own assessment for each destination and share it on request; ask for it rather than starting from a blank page, but read it critically, because it is your accountability, not theirs.

A provider that cannot tell you which countries your files touch has not done the work, and your assessment cannot do it for them.

Where are the providers we review headquartered?

We record each provider’s headquarters, which is useful context for who you are contracting with. It is not evidence of where your files are stored, and we have not verified hosting regions for any provider.

Every provider in this list is cloud based, and Drooms also offers on-premise deployment, which changes the analysis entirely because the files sit on infrastructure you control. A UK headquarters does not guarantee UK hosting, and a US or Australian headquarters does not rule it out. Some providers let you pick a region per room; others do not. The only reliable answer is the one in the contract.

How do you check a provider before you sign?

1. Ask for the hosting map in writing

   Request the countries used for primary storage, backups, disaster recovery and search indexing for your room, and whether you can choose a region.

2. Ask who can access the files and from where

   Find out which support, engineering and administrator teams can view customer content, in which countries, and under what controls.

3. Get the sub-processor list

   Ask for the current list with each sub-processor's role and location, and how you will be told about changes.

4. Identify the transfer mechanism for each country

   For each location outside the UK, ask whether it relies on adequacy regulations, the IDTA, the UK Addendum or something else.

5. Request the transfer risk assessment

   Ask for the provider's own assessment for each non-adequate destination, then record your review of it.

6. Read the processing agreement

   Check that the data processing addendum covers Article 28 terms and incorporates the IDTA or Addendum where needed.

7. File the answers with the deal records

   Keep the replies alongside your legitimate interests assessment so they are ready if a buyer, an employee or the ICO asks.

Do AI features change the hosting question?

They can. Several rooms in our data, including Ellty, Datasite, Ansarada, Drooms and Box, offer built-in AI tools for things like summarising documents, suggesting folder structures or answering questions across the room. Where those features process document content, ask where that processing happens and whether any third-party model provider is involved.

Useful questions: does the AI feature send content outside the provider’s own infrastructure; if so, to whom and in which country; is customer content used to train any model; and can the feature be switched off for a particular room or folder. A provider with a clear answer to all four is in a stronger position than one that offers a general statement about “enterprise-grade AI”.

None of this is a reason to avoid AI features. On a large sale they save real time. It is a reason to put the AI sub-processors on the same list as the storage ones.

What if the buyer or its advisers are outside the UK?

Your provider is only one leg. When a bidder in the United States or Singapore downloads a document, that is a transfer from you to the bidder, a separate controller. The usual approach combines a clear NDA, staged disclosure so that personal data reaches overseas bidders late and in minimised form, and, where personal data is genuinely needed, an appropriate safeguard or an exception that fits the facts. Our guide to UK GDPR in a data room covers staging in detail.

Settings in the room help here too: view-only access for sensitive folders, dynamic watermarking, and document rights control that can withdraw access to downloaded files later. Every provider we review has a full audit trail, which records who opened what and from which account.

Does the EU side matter for a UK deal?

Sometimes. If the target has an EU subsidiary, EU personal data may also go into the room, and that is governed by the EU GDPR. The EU recognises the UK as adequate under decisions it reviews periodically, so transfers from the EU to a UK seller are generally straightforward, but onward transfers from the UK to a third country then need to respect the EU rules as well. Where a target has meaningful EU operations, involve its EU counsel early.