§ Guide

Custodian Abroad Cross Border Collection

This guide, 'Custodian Abroad: Cross-Border Collection', is for UK lawyers dealing with evidence located in another country.

Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active

Guide · 17 pages · 26 min read · Published 2026-08-31

This guide, 'Custodian Abroad: Cross-Border Collection', is for UK lawyers dealing with evidence located in another country. It covers international data transfer under the UK GDPR, blocking statutes, and local law that may forbid disclosure. The guide outlines routes for collection, including cloud-side, in-country collection, and letters of request. It addresses planning the cross-border collection with local counsel, reconciling English disclosure duties with foreign law, and source architecture. It includes worked examples, common mistakes, technical limitations, and questions to ask. This resource is essential for anyone facing the legal and technical challenges of collecting data from a custodian abroad.

Read this guide on your phone, browse guides by topic or go back to the full PDF library.

§ Credit and source

Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. The authority behind this subject is ICO guide to the UK GDPR, which you should read alongside this guide. See every guide's author and source.

§ Full text of Custodian Abroad Cross Border Collection

Download the PDF

Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.

Page 1

CROSS - B ORDER COLLECTION · A GUIDE FOR UK LAWYERS Custodian Abroad: Cross-Border Collection Data Transfer, Blocking Statutes and Local Law When the Evidence Sits in Another Country COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES CROSS-B ORDER COLLECTION TRANSFER & BLOCKING-STATUTE ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is under someone else's law 03 International data transfer under the UK GDPR 04 Blocking statutes and local law that forbid what disclosure demands 05 The routes: cloud-side, in-country collection and letters of request 06 Planning the cross-border collection with local counsel 07 Deployment: reconciling English disclosure duties with foreign law 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ACUSTODIANABROADTURNSCOLLECTIONINTOALEGAL EXERCISEBEFOREATECHNICALONE: THEDATAISUNDERLOCALLAW, ITS TRANSFER TOENGLANDISRESTRICTED, ABLOCKINGSTATUTEMAYCRIMINALISEEXPORT, AND THEEVIDENCEMUSTBECOLLECTEDBYAROUTETHATSATISFIESENGLISHDISCLOSURE ANDFOREIGNLAWATONCE, PLANNEDWITHLOCALCOUNSELFROMTHESTART

§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is under someone else's law

§ 03 · INTERNATIONALDATATRANSFER International data transfer under the UK GDPR

Page 2

§ 04 · BLOCKINGSTATUTESANDLOCALLAW Blocking statutes and local law that forbid what disclosure demands

§ 05 · THEROUTES The routes: cloud-side, in-country collection and letters of request

§ 06 · PLANNINGWITHLOCALCOUNSEL Planning the cross-border collection with local counsel

§ 07 · DEPLOYMENT Deployment: reconciling English disclosure duties with foreign law

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION (VARIOUS DATA CHANNEL DEVICE CONTROLLED ENTIT Y'S ABROAD CLOUD OWN ACCOUNT SYSTEMS COUNTERPARTIES PROVIDER FORMAL- JURISDICTIONS) CENTRES ONLY

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEBLOCKINGSTATUTEANDTHELETTEROFREQUEST EXAMPLE2 · THECLOUDACCOUNTTHATNEVERLEFTTHEUK ' SCONTROL EXAMPLE3 · THEIN - COUNTRYCOLLECTIONTHATWAITEDFORTHETRANSFER MECHANISM

Page 3

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider (and local counsel) SUGGESTED WORDING · INSTRUCTION FOR ACROSS - B ORDER COLLECTION

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The cross-border-collection checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions The court has ordered disclosure. Can we just image the custodian's device abroad? What is a blocking statute and why does it matter so much? Is moving the data to England just a logistics question? Can cloud-side collection avoid the whole problem? What do we tell the English court if foreign law blocks disclosure? Can the employee just consent to us collecting their device abroad?

§ 14 · REFERENCE Glossary IDTA Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY

§ Common questions

Frequently asked questions

The court has ordered disclosure. Can we just image the custodian's device abroad?
No: an English order does not make it lawful to collect and export data in another country, whose law governs the data (§2). Depending on the jurisdiction, self-help collection may breach data-protection, labour, secrecy or blocking-statute law, and in some places be a criminal offence (§4, Example 1). Engage local counsel first and choose a route lawful where the data sits.
What is a blocking statute and why does it matter so much?
It is a law that criminalises gathering or export in g evidence located in the country for foreign proceedings otherwise than through official channels (the French statute is the classic example, §4). It matters because the ordinary collection English disclosure expects can be a crime where the data sits, and the only lawful route may be a letter of request through the foreign court (§5, Example 1): slow, but lawful.
Is moving the data to England just a logistics question?
No: it is a restricted international transfer under the UK GDPR needing a lawful transfer mechanism (adequacy, the IDTA or Addendum, or a litigation derogation) and usually a transfer risk assessment (§3). Treating it as mere logistics is a data-protection breach in the collection itself. Data minimisation, transferring only relevant material, reduces both the risk and the volume crossing the border.
Can cloud-side collection avoid the whole problem?
It can avoid much of it where the data sits in a UK-controlled corporate account, because collection happens server-side without a foreign act or a foreign-device search (§5, Example 2): but it does not dissolve local law, the custodian's personal data is still processed and their local rights and the provider's data-centre locations may still bite. It is often the cleanest route, but the local-law analysis still applies.
What do we tell the English court if foreign law blocks disclosure?
The truth, early and with evidence: put the constraint to the court candidly, supported by local-counsel evidence, and show the lawful maximum being done, letters of request, in-country collection, cloud-side routes (§7, Example 1). The court distinguishes a genuine, evidenced foreign-law bar from a party sheltering behind an overstated one, and rewards the party that surfaced and planned around the constraint rather than concealing it.
Can the employee just consent to us collecting their device abroad?
Sometimes, but be careful: many jurisdictions treat employee consent as not freely given and disregard it (§5,
§ Related documents
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

WhatsApp