Overseas Personalisation Printing Needs a Data-Transfer Decision

Before sending recipient information to a separate overseas printing company, a brand whose processing is covered by UK GDPR needs to decide whether the arrangement is a restricted transfer and who is responsible for it.

Keeping the file on a UK server does not remove that decision. Allowing the overseas printer to access the file may trigger the same transfer rules as sending a copy.

The practical rule is to identify the receiving legal entity, apply the Information Commissioner’s Office (ICO) three-step test, and establish the appropriate transfer mechanism before sending information or enabling access. A small order, a processor agreement or an agreed print specification does not automatically satisfy those requirements.

The three-step test applies to the proposed information flow

The ICO asks organisations to determine whether all three conditions are met:

1. UK GDPR applies to the processing. Establish whether the relevant personal information and processing activity fall within UK GDPR. The fact that printing takes place abroad does not, by itself, answer this question.
2. The organisation initiates a transfer to an overseas organisation. Identify who chose the receiving organisation and designed the arrangement that causes the information to be sent or made accessible. The person physically uploading the file is not necessarily the initiator.
3. The receiver is a separate legal entity. Establish whether the recipient is another company or other separate organisation, rather than part of the same legal entity.

When all three conditions are met, the proposed flow is a restricted-transfer arrangement requiring a lawful covering mechanism.

The receiving organisation’s legal establishment matters. A storage location, overseas workstation or familiar brand name cannot substitute for checking the actual entity involved.

See the ICO’s detailed three-step guidance.

Sending a file and permitting remote access require the same classification

Consider an entirely hypothetical gift brand, BrandEntity, established in the UK. It controls recipient-personalisation data and wishes to use SeparatePrinter, an independent company established outside the UK.

The only illustrative field identifier is RecipientFieldR1. It stands for information that would identify a recipient in a real printing workflow. No actual recipient information is used in this example.

BrandEntity chooses SeparatePrinter directly and determines how that printer will receive the information.

These outcomes do not depend on whether the printer can download the file. Viewing personal information remotely can be sufficient.

There is an important timing distinction in arrangement B: the restricted transfer occurs upon the overseas organisation’s access, but the required covering mechanism must already have been ensured when BrandEntity makes access possible. The review cannot be postponed until after the first viewing session.

Nor does the same-entity result extend automatically to another company within BrandEntity’s corporate group. A group subsidiary may be a separate legal entity even if it shares ownership, branding or management.

The initiator is determined by who chooses the processing route

In arrangements A and B, BrandEntity deliberately selects SeparatePrinter and establishes the overseas printing arrangement. BrandEntity therefore initiates the transfer.

Now suppose BrandEntity separately employs a hypothetical UK print studio to prepare the artwork.

If BrandEntity has chosen and contracted with SeparatePrinter, then instructs its UK studio to upload the file, BrandEntity remains the initiator. The studio operating the upload button does not change that responsibility.

A different arrangement produces a different answer.

Suppose the UK studio acts as BrandEntity’s processor, designs its own printing service, selects an overseas sub-processor and contracts with that overseas company to deliver part of the service. Under the ICO’s approach, the UK studio would normally initiate the restricted transfer to its chosen sub-processor.

The UK studio must have BrandEntity’s prior specific or general written authorisation before engaging that sub-processor. Existing general written authorisation may cover the engagement without fresh authorisation for each change, subject to the required notice of intended additions or replacements and BrandEntity’s opportunity to object. Authorisation is not the same as initiating the transfer.

The party responsible for the transfer rules depends on the actual contractual and processing structure, not simply whether it is called the brand, supplier, controller or processor.

Whoever initiates the transfer must address the transfer rules. Other parties retain their applicable UK GDPR and contractual responsibilities.

A covering mechanism must be established before access

Once the three-step test identifies a restricted transfer, the initiating organisation needs to establish which lawful route covers it.

The current UK GDPR framework includes Article 44A, introduced in February 2026, with three principal routes:

• UK adequacy regulations: Check whether applicable UK regulations under Article 45A cover the relevant destination, territory, sector or organisation and the proposed transfer.
• Appropriate safeguards: Assess an applicable Article 46 safeguard, potentially including a properly executed UK International Data Transfer Agreement (IDTA) or International Data Transfer Addendum. The ICO also requires a transfer risk assessment (TRA), any necessary additional protections and legally effective safeguards.
• Specific derogations: Assess whether an Article 49 exception actually applies where the other routes do not cover the transfer. An ordinary, recurring personalisation service should not assume an exceptional route is available merely because the print quantity is small.

Article 44A also refers to possible restrictions under Article 49A that must be considered where relevant.

The Data (Use and Access) Act changed the terminology of the Article 46 assessment. UK legislation now refers to a data protection test, while the ICO continues to call the practical assessment a TRA. The test requires a reasonable and proportionate determination about whether protection following transfer would be materially lower than in the UK.

Merely proposing an IDTA, naming a contract template or obtaining approval for a printing purchase does not establish appropriate safeguards.

If no applicable covering mechanism can be established, the decision is not to enable the restricted transfer.

For the hypothetical SeparatePrinter arrangements, the destination-specific legal position, contractual documents and assessment results remain unknown. Neither arrangement A nor B is approved by this article.

See the ICO’s guidance on transfer mechanisms.

The output is an access decision, not another artwork approval

Before releasing personal information, the brand can create one concise decision record for each proposed printing route.

That record should identify the UK GDPR processing scope, the receiving legal entity and its establishment, whether information will be sent or remotely accessed, the party initiating the transfer, the three-step answers, and the applicable mechanism review status.

For the hypothetical arrangements A and B, the provisional decision record would read:

RecipientFieldR1 → SeparatePrinter → Restricted transfer identified → Mechanism unverified → DO NOT SEND / DO NOT ENABLE ACCESS.

This is not a security certificate or a legal approval. It is a specific instruction that prevents the printing workflow from proceeding on an unverified assumption.

A brand may also investigate whether truly generic, non-personal packaging artwork can be printed separately and recipient-specific personalisation added locally. Whether that production arrangement is practical requires separate confirmation.

Replacing a name with an internal code is not automatically anonymisation. If the information remains personal data in BrandEntity’s hands as controller, it remains personal data for its printer acting as processor, whether or not the key or mapping table is shared. For a recipient that is neither a processor nor a joint controller, whether the information is genuinely anonymous in that recipient’s hands requires a separate assessment.

This access decision complements, rather than repeats, existing packaging planning:

• How to Personalize Gift Packaging addresses where changing content belongs.
• Gift-Ready Ecommerce Packaging addresses how order and recipient instructions reach fulfilment.
• A Print File Manifest addresses artwork files, fonts, linked assets and output versions.

Those decisions do not establish permission to transfer personal information internationally.

Packrivo coordinates packaging sourcing and project questions; it does not determine whether a particular organisation’s international data-transfer mechanism satisfies UK GDPR.

The next action is to settle the legal-entity, initiator and mechanism questions before granting a printer access to recipient information—not after the artwork has already been released.

Sources and legal scope

This article uses the ICO’s brief international transfers guide and detailed international transfers guidance, updated 15 January 2026.

The legislative reference is UK GDPR Chapter V, checked against the official 30 September 2026 revision, particularly Articles 44A, 45A, 46, 49 and 49A. The ICO’s separate controller–processor contract guidance is marked as under review following the Data (Use and Access) Act.

All printing arrangements, entities and field identifiers in this article are illustrative. No destination, safeguard, provider arrangement or transfer has been assessed or approved for a real business. This is general buyer education, not legal advice.

A revised file needs a separate proposed-access scope

Compare two invented output identities before a handoff. GENERIC29 contains only a generic greeting and no recipient-specific information under the exercise premise. CODE29 adds OrderTokenR1, assumed linkable to a person in the controller’s records, for a separately established overseas printer acting as processor. The token is a field identifier, not an actual order or recipient. Keeping the file names distinct prevents a review of generic artwork from being carried over to a changed information flow.

Scroll horizontally if columns extend beyond the view.

Hypothetical configuration	Named object	Relationship	Input or next scope
GENERIC29	GENERIC29	assumed content	GENERIC_GREETING_ONLY
CODE29	CODE29	assumed content	LINKABLE_OrderTokenR1
CODE29	RECEIVER	assumed	SEPARATE_OVERSEAS_PROCESSOR
CODE29	NAME_REMOVED_MAPPING_WITHHELD	does not automatically establish	ANONYMISATION
CODE29	GENERIC_ARTWORK_REVIEW	does not cover	CHANGED_FILE_AND_INFORMATION_FLOW
CODE29	RECEIVING_ENTITY_ACCESS	requires	EXACT_FILES_LINKED_ASSETS_AND_EARLIER_OUTPUT_SCOPE
CODE29	REPLACED_VISIBLE_PDF	does not establish	OTHER_FILE_DELETED_OR_INACCESSIBLE
CODE29	RESTRICTED_TRANSFER_IF_THREE_CONDITIONS	requires	COVERING_MECHANISM_BEFORE_ACCESS_ENABLED
CHAPTER_V29	LATER_INDEPENDENT_GET	obtained	KEY_CURRENT_CLAUSES_NOT_FULL_LAW_OR_DESTINATION_APPROVAL
CHAPTER_V29	44A_45A_49A_NOTES	retain	DIFFERENT_COMMENCEMENT_SCOPES
SOURCE29	15JAN2026_INDEX_DATE	not verified for	EVERY_CHILD_PAGE

The processor premise matters. Removing the name and withholding the lookup table do not make the linkable code anonymous merely because the printer cannot interpret it alone. Keep CODE29 in the personal-data review under that premise. For a receiver that is neither processor nor joint controller, whether data is genuinely anonymous in that receiver’s hands needs a separate assessment; this exercise supplies no universal anonymity rule.

For either proposed file, identify what the receiving entity would actually be able to access, including linked assets or a retained earlier output. Replacing the visible PDF does not demonstrate that another accessible file has disappeared. The file manifest can identify that unresolved scope without enabling access or claiming deletion. The relevant owner must decide which exact file and access arrangement is covered; a print appearance approval is a different decision.

If the ICO three-step conditions identify a restricted transfer for CODE29, the applicable covering mechanism must be established before access is made possible, with destination, safeguards, Article 49A restrictions and other relevant duties still to review. The independent source follow-up obtained current Chapter V and read the key 44A/45A/46/49/49A framework. Its changes have different commencement scopes, not one blanket date. The ICO guide index’s 15 January 2026 update is not a verified modification date for every child page. No actual file, personal data or transfer is approved.

Download the personalisation print file access linked code data scope record (.csv). It includes the original table fields and scenarios alongside the added relationships. HYPOTHETICAL rows are editorial examples or required review scopes, not actual records. Actual quantity, configuration, component and file identities, materials, process, specification, copy, method, condition, observation, owner, decision, evidence and dates are blank. ACTUAL_BLANK is a separate empty starting row; enter permitted project evidence before using an actual record. A blank means unknown.

Use the Packaging Print File Checklist: Fonts, Links and Output for its separate question.

Source scope checked 17 October 2026: The ICO access/entity/initiation and covering-mechanism guidance remains conditional. A later independent ordinary GET acquired current Chapter V and key clauses/revision notes, partially closing the earlier WebGPT access gap. Different commencement scopes, destination/transition details, safeguards and actual access remain for responsible review. The guide-index update date is not assigned to every child page. The added configurations and calculations are hypothetical, with actual evidence and decisions pending.

Discuss this packaging specification with Packrivo. We coordinate independent suppliers. MOQ: 500 pieces per product/design; illustrative quantities are not production offers. Confirm materials, samples, price and timing for your project.