UK GDPR contains rules about transfers of personal data to receivers located outside the UK, or making personal data accessible to a receiver located outside of the UK. So even if data is not transferred, the act of accessing the data from outside of the UK brings it into the UK GDPR net. 

The transfer rules do not apply where the receiver is an employee of the sender, or the sender and receiver are part of the same legal entity, such as a company, so UK GDPR is not an issue for offshoring where the staff are employees of the UK practice. 

This ICO guide to international transfers is very helpful.

What compliance with UK GDPR looks like

If you have outsourced staff based outside of the UK, the staff are employed by the outsourcing company rather than the UK practice so the transfer of personal data to them – or their remote access of the UK practice's data - is a 'restricted transfer'.  In which case you must first look at whether there are UK 'adequacy regulations' for the country or territory where the outsourced team is located. Adequacy here means "not materially lower" than provided for by UK law. If there is an adequacy regulation for that country, then that is fine. However some of the most popular countries for outsourcing – India, Philippines and South Africa - do not currently (February 2026) have UK adequacy regulations. 

If you are outsourcing to countries with no UK adequacy regulations, then one way to comply with UK GDPR rules on restricted transfers is to put in place an Article 46 transfer mechanism. These are the "appropriate safeguards" listed in Article 46 of the UK GDPR. Examples are the ICO's International Data Transfer Agreement (IDTA), the Addendum to the EU SCCs (the Addendum) and Binding Corporate Rules (BCRs).

If you are relying on an Article 46 transfer mechanism you must carry out a Transfer Risk Assessment (TRA) - a process that evaluates the risk of harm to people's rights and freedoms when personal data is transferred to a country outside the UK (or EU) that doesn't have an "adequacy decision" for data protection. A TRA will help you ensure that the method you use for international data transfer provides adequate safeguards and that people's rights remain protected despite the transfer. It will identify risk, analyse their impact and determine if mitigation measures are needed to ensure appropriate protection for the data subjects. Read more on the ICO website.