Deadline looming to implement UK international transfer of personal data amendments
Incoming changes to UK data protection laws means those using the EU standard contractual clauses (SCCs) in order to safely transfer personal data outside the UK are expected to update their documentation to bring them into line with equivalent UK-mandated contractual clauses.
Under UK data protection law there are restrictions on transferring personal data outside of the UK. Personal data can only be transferred outside of the UK without restriction if it is to another country whose data protection practices the Information Commissioner’s Office (ICO) has deemed “adequate”. The largest block of countries that the ICO has deemed to be adequate is the EEA, although the full list of countries is available on the ICO’s website. Any countries which have not been deemed adequate are referred to as “third countries”.
For proposed transfers of personal data to third countries, data protection legislation requires that other “appropriate safeguards” are put in place. The most common measure relied upon to date has been the SCCs; a comprehensive set of standard clauses developed by the EU relating to the transfer of personal data. They are intended to be included in a contract between the parties and set out the obligations between the parties relating to the data transfer.
Following Brexit, SCCs alone are insufficient to safeguard the transfer of personal data to third countries. Consequently, in March 2022, the ICO published the documents which are intended to replace SCCs. These are:
- The UK International Data Transfer Agreement (IDTA): a standalone agreement which is intended to apply to the transfer of personal data from the UK to third countries; and
- The IDTA Addendum; an “add on” document to the SCCs which amends the SCCs to make them suitable for UK transfers.
For any new contracts entered into since September 2022 which include international transfers of personal data to third countries, the SCCs have been deemed an invalid mechanism for the transfer and instead parties have had to use the IDTA or IDTA Addendum.
Contract which were entered into before September 2022 have been given a longer grace period in which to make the switch to the IDTA or IDTA Addendum. For these contracts, their existing SCCs have continued to remain a suitable method for international data transfers. However, by 21 March 2024 all existing contracts must have been updated to the IDTA or the IDTA Addendum.
If you have not already done so we recommend that you review your contracts which include international data transfers. If the contracts still rely on SCCs you should update these to reflect the IDTA or IDTA Addendum, as appropriate, before 21 March 2024.
Speak to a specialist
For further information please contact our corporate and commercial team.
Posted:
