How can personal data be transferred out of the UK lawfully?

A transfer is lawful where the destination is covered by UK adequacy regulations, or where an appropriate safeguard applies, in practice the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment. Binding corporate rules and the narrow derogations, including explicit consent and contractual necessity, remain available. The exporter stays accountable for the data after it leaves the United Kingdom.