In February of this year, the DCMS placed a new set of documents before Parliament – the International Data Transfer Agreement (the “IDTA”), an International Data Transfer Addendum to the EU’s revised standard contractual clauses (the “UK Addendum”), and supporting transitional provisions.
The IDTA is the UK’s long awaited replacement for the previous version of the EU standard contractual clauses (SCCs). SCCs are one of the most common methods for safeguarding international flows of personal data between the UK and a jurisdiction which has not been recognised as having an adequate data protection regime. However, over the past few years as the data industry has expanded and grown more complex, the previous version of EU SCCs began to show their age – in particular there have been a number of use cases (such as a processor exporting data to a controller) which fell outside of the original design intent of the SCCs.
The IDTA seeks to solve this issue by allowing for all permutations of transfer between processors and controllers. Alternatively, the UK Addendum serves to extend the protection of the EU’s current SCCs (only introduced following the UK’s withdrawal from the EU), so that they can also be used to safeguard personal data subject to the UK GDPR. This single set of clauses acceptable to both the EU and the UK is a useful solution for any organisation which exports both EU and UK personal data to a third country.
The ICO has announced that the new documents are expected to come into force on the 21 March 2022; after 21 September 2022 the previous set of EU SCCs can no longer be entered into for new agreements; and after 21 March 2024 the previous set of EU SCCs will no longer be an appropriate safeguard within any agreement, new or old.
Also note that it is not sufficient to simply implement the IDTA or UK Addendum - data exporters are required to go further and carryout data transfer risk assessments to assess local laws and the technical and contractual measures in place, to confirm that the IDTA or UK Addendum is in fact an appropriate safeguard for the transfer.
For more information on this article, please contact Hannah Pettit.
Data protection webinar: privacy considerations for workplace monitoring
Assessing the impact of the Clearview AI decision - how clear is the future of the UK’s AI data protection law?
An evening with expedition leader and TEDx Bristol speaker, Oli France
We produce a range of insights and publications to help keep our clients up-to-date with legal and sector developments.
Sign up
