Skip to main content
Privacy Track
Category: Data Transfers

Administrative Arrangement

Simply put

In the data protection context, an administrative arrangement is a document, such as a memorandum of understanding, agreed between public bodies (or between a public body and an international organisation) to provide safeguards for personal data transferred between them. It offers a way to protect data being sent internationally where the parties are public authorities. Because it is not legally binding in the same way as a contract, it must be authorised by the relevant supervisory authority before it can be relied upon as a safeguard.

Formal definition

Under the UK GDPR, an administrative arrangement is a transfer mechanism that can serve as an appropriate safeguard for international transfers of personal data between public authorities and bodies, and typically takes the form of a non-legally binding instrument such as a memorandum of understanding. Per ICO guidance, it is usually made between a public body and another public body, an international organisation, or a similar counterpart, and requires authorisation by the ICO (as the competent supervisory authority) before it can be used as a valid transfer tool. This entry describes the position under the UK GDPR framework as reflected in ICO guidance; the equivalent mechanism exists in the EU GDPR regime, and readers should verify the applicable statutory provisions, the current authorisation requirements, and any relevant conditions against the official text, as this is distinct from other administrative-arrangement concepts (for example, Australian Administrative Arrangements Orders allocating executive responsibility) that share the name but are unrelated to data protection safeguards.

Why it matters

International transfers of personal data between public bodies raise a specific problem: the usual contractual transfer tools do not always fit the way public authorities operate or hold their powers. An administrative arrangement addresses this by allowing public bodies, or a public body and an international organisation, to set out data protection safeguards in an instrument such as a memorandum of understanding. This gives public-sector actors a route to move personal data across borders while still providing appropriate safeguards, rather than being left without a usable mechanism.

The critical feature to understand is that an administrative arrangement is typically not legally binding in the same way as a contract. Because of this, it cannot simply be adopted and relied upon by the parties on their own initiative. Under the UK GDPR framework as reflected in ICO guidance, it must be authorised by the ICO as the competent supervisory authority before it can function as a valid transfer tool. That authorisation requirement is what distinguishes it from transfer mechanisms that parties can put in place without prior regulatory sign-off, and it means the safeguards will have been scrutinised before the transfer proceeds.

The term also carries a real risk of confusion, which matters for anyone researching or drafting compliance documents. The phrase "administrative arrangement" is used in wholly unrelated contexts, most notably the Australian Administrative Arrangements Orders, which allocate executive responsibility among ministers and departments and have nothing to do with data protection safeguards. Practitioners should confirm they are relying on the data protection meaning and verify the applicable statutory provisions and current authorisation requirements against the official text, as the equivalent EU GDPR mechanism should be checked separately.

Who it's relevant to

Public bodies and authorities
Public authorities that need to transfer personal data internationally to another public body or an international organisation may use an administrative arrangement as an appropriate safeguard. They should understand that such an instrument is typically not legally binding in the usual contractual sense and therefore requires ICO authorisation before it can be relied upon.
International organisations
International organisations receiving personal data from a UK public body may be counterparties to an administrative arrangement, such as a memorandum of understanding, setting out the safeguards applicable to the transfer. They should be aware that the arrangement's status as a valid transfer tool depends on authorisation by the competent supervisory authority.
Data protection officers and compliance leads in the public sector
Those advising public-sector organisations on cross-border transfers need to identify when an administrative arrangement is the appropriate mechanism, ensure ICO authorisation is obtained before reliance, and take care not to confuse this data protection instrument with unrelated concepts that share the name, such as Australian Administrative Arrangements Orders.
Legal advisers on international transfers
Lawyers structuring public-sector international transfers should verify the applicable UK GDPR provisions, current authorisation requirements, and any conditions against the official text, and should separately confirm the position under the equivalent EU GDPR mechanism where relevant, as these frameworks can differ and evolve.

Inside Administrative Arrangement

Legal basis under Article 46(3)(b)
An administrative arrangement is one of the transfer tools available for international transfers of personal data between public authorities or bodies. Under Article 46(3)(b) GDPR, provisions inserted into administrative arrangements between public authorities or bodies may provide appropriate safeguards, but this route requires prior authorisation from the competent supervisory authority. Readers should verify the article reference against the current official text.
Enforceable and effective data subject rights
Because an administrative arrangement is typically not a legally binding instrument between the parties in the same way as contractual clauses, it must nonetheless include enforceable and effective rights and remedies for data subjects. This distinguishes it from legally binding arrangements under Article 46(3)(a) and is a focus of regulator guidance.
Prior supervisory authority authorisation
Unlike Standard Contractual Clauses, which generally do not require case-by-case authorisation, an administrative arrangement relies on obtaining authorisation from the competent supervisory authority before the transfer proceeds. The specifics of that process may vary between member states and should be confirmed with the relevant regulator.
Appropriate safeguards content
The arrangement typically sets out safeguards such as purpose limitation, data quality and proportionality, transparency, security measures, onward transfer conditions, redress mechanisms, and oversight. The precise set of safeguards expected is informed by regulator guidance rather than an exhaustive list in the Regulation text.
Public authority or body context
This tool is generally used where the transferring and receiving entities are public authorities or bodies. It is not the standard mechanism for transfers involving private commercial entities, which more commonly rely on tools such as Standard Contractual Clauses or, where applicable, Binding Corporate Rules.

Common questions

Answers to the questions practitioners most commonly ask about Administrative Arrangement.

Is an administrative arrangement the same as a Standard Contractual Clause or another contractual transfer tool?
No. An administrative arrangement is a distinct transfer mechanism used between public authorities or bodies, and it should not be conflated with Standard Contractual Clauses, which are a separate contractual tool. While both can serve as safeguards for transfers, they differ in nature: an administrative arrangement is typically a non-legally-binding instrument agreed between public bodies, whereas Standard Contractual Clauses are contractual and legally binding. The precise conditions and article basis should be verified against the current official text, and readers should note that guidance in this area can evolve.
Can public authorities rely on an administrative arrangement automatically, without any additional step?
Not automatically. An administrative arrangement is generally not self-executing as a transfer safeguard. In most cases it requires authorisation from the competent supervisory authority before it can be relied upon to provide appropriate safeguards. This distinguishes it from certain other mechanisms that may be used without prior authorisation. The exact procedural requirements should be confirmed against the current Regulation text and applicable regulator guidance, as approaches can vary.
How do we determine whether an administrative arrangement is the appropriate mechanism for a particular transfer?
The suitability depends on context, including the identity of the parties and the nature of the transfer. Administrative arrangements are typically considered where the parties are public authorities or bodies and other contractual tools may be less suitable to their public-law relationship. An organisation should assess the parties involved, the safeguards to be provided, and whether supervisory authority authorisation would be required. Because this is context and risk dependent, and because guidance in this area continues to develop, the specific choice should be documented and verified against the current official text.
What role does the supervisory authority play when using an administrative arrangement?
In most cases the competent supervisory authority has an authorisation role, meaning the arrangement generally needs to be approved before it can be relied upon as providing appropriate safeguards. Organisations should engage with the relevant authority early and confirm the applicable procedure, as the precise requirements and the extent of any consistency review across authorities should be checked against the current official text and regulator guidance rather than assumed.
What safeguards should an administrative arrangement typically address to support a transfer?
An administrative arrangement is generally expected to set out enforceable and effective safeguards for the rights of the data subjects concerned. In practice this typically involves provisions addressing how personal data will be protected in the receiving jurisdiction and how individuals' rights are supported. The specific content and the standard applied are subject to assessment and to the requirements set out in the current Regulation text and applicable guidance, which should be verified rather than presumed.
Should we treat an administrative arrangement as a permanent solution once authorised?
It is safer not to treat any transfer safeguard as permanent. Transfer mechanisms, supplementary measures, and the broader legal landscape evolve, so an administrative arrangement should be kept under review to confirm it continues to provide appropriate safeguards in light of current conditions. Organisations should periodically reassess and verify the position against the current official text and regulator guidance, as divergence between regulators and changing circumstances can affect ongoing reliance.

Common misconceptions

An administrative arrangement works like a Standard Contractual Clause and can be adopted without regulator involvement.
In most cases the administrative arrangement route under Article 46(3)(b) requires prior authorisation from the competent supervisory authority, whereas Standard Contractual Clauses generally do not require case-by-case authorisation. The two are distinct transfer tools and should not be conflated.
Because it is administrative rather than contractual, the arrangement need not give data subjects real rights.
Even where the instrument is not legally binding between the parties, it must still provide enforceable and effective rights and remedies for data subjects to qualify as an appropriate safeguard. The non-binding administrative nature does not remove this requirement.
Administrative arrangements are a general-purpose mechanism suitable for any international transfer.
This tool is typically relevant to transfers between public authorities or bodies. Private-sector transfers generally rely on other Article 46 tools, and the suitability of any mechanism is subject to assessment of the specific transfer scenario.

Best practices

Confirm early whether the transfer genuinely involves public authorities or bodies, since this determines whether an administrative arrangement is an appropriate tool rather than Standard Contractual Clauses or another Article 46 mechanism.
Engage the competent supervisory authority in advance and build the required prior authorisation step into your project timeline, recognising that process expectations may vary between member states.
Ensure the arrangement expressly provides enforceable and effective rights and remedies for data subjects, and document how those rights can be exercised in practice.
Map the safeguards in the arrangement (such as purpose limitation, security, onward transfer controls, and redress) against current regulator guidance rather than relying on the Regulation text alone.
Assess the situation in the destination jurisdiction and consider whether supplementary measures are needed, treating the arrangement as one part of a broader transfer risk assessment.
Review the arrangement periodically, as adequacy positions, transfer tools, and guidance evolve, and verify any article references or procedural requirements against the current official text before relying on them.