On 28 January 2022, the final version of the international data transfer agreement (“IDTA”) and the international data transfer addendum to the European Commission’s standard contractual clauses (“SCCs“) for international data transfers has been laid before the UK Parliament. This follows the ICO’s public consultation which was launched in August 2021. If there are no objections, the document will enter into force on 21 March 2022.
Under UK GDPR, organisations transferring personal data outside of the UK to organisations in countries which are not providing adequate protection must implement appropriate safeguards using the SCCs previously adopted by the European Commission (known as the “old SCCs”). However, on 4 June 2021, the European Commission replaced the old SCCs with new EU SCCs for transfers of personal data outside of the EEA. See more on the transition to the new EU SCCs here.
The IDTA is the UK’s equivalent of the new EU SCCs, and is aimed to cover data transfers outside of the UK under the UK GDPR. This was issued by the ICO pursuant to section 119A of the DPA 2018, and will replace the current SCCs used for personal data transfers from the UK to third countries.
For organisations that also transfer personal data outside of the EU/EEA, the UK will recognise the new EU SCCs as appropriate safeguards for transfers out of the UK, subject to the parties also using the IDTA addendum to the new EU SCCs. This allows organisations to use only one set of SCCs: the new EU SCCs together with the IDTA addendum, instead of both the new EU SCCs and the IDTA.
Timeline:
- For contracts concluded on or before 21 March 2022, organisations can continue to use the old EU SCCs, provided that there has been no change in the processing operations and that the existing contract implements adequate safeguards in compliance with Schrems II. However, organisations will need to update these agreements no later than 21 March 2024 and use either the IDTA, or the new EU SCCs together with the IDTA addendum.
- For contracts concluded between 21 March 2022 and 21 September 2022, organisations will have three options:
- use the old EU SCCs. However, organisations will need to update these agreements no later than 21 March 2024;
- use the IDTA; or
- use the new EU SCCs together with the IDTA addendum.
- For contracts entered into on or after 21 September 2022, organisations will be required to use the IDTA, or the new EU SCCs together with the IDTA addendum.
The ICO will also publish additional guidance to provide support to organisations, including:
- Clause by clause guidance to the IDTA and Addendum.
- Guidance on how to use the IDTA.
- Guidance on transfer risk assessments.
- Further clarifications on the ICO’s international transfers guidance.
See the ICO’s statement here.
Please contact Jose Saras if you have any questions regarding the above.
The material contained in this article is only for general review of the topics covered and does not constitute any legal advice. No legal or business decision should be based on its content.