In line with the DPA:

"Data Transfers

6.1 In accordance with UK and EU GDPR Article 28(3)(a), the Supplier shall not, and shall not permit any Sub-processor to, transfer any Customer Personal Data outside the EEA or the UK (as applicable) other than as provided in this Agreement. For the avoidance of doubt, the Customer hereby consents to the transfer and processing of the Personal Data as specified in Annex A, as it applies.

6.2 The Supplier acknowledges that in accordance with the UK and EU GDPR, adequate protection for the Personal Data must exist after any transfer outside the UK or EEA (either directly or via a Sub-processor’s onward transfer) and shall enter into an appropriate agreement with the Customer and/or any sub-processor to govern such a transfer. This will include the applicable Standard Contractual Clauses unless another adequacy mechanism for the Transfer exists."