International Data Transfer Agreement and the addendum to EC Standard Contractual Clauses expected in force 21 March 2022

If no objections are raised by parliament, these documents will come into force on 21 March 2022. The IDTA and the Addendum will become new tools for compliance with Art. 46 UK GDPR when making restricted data transfers from the UK to third countries.

New standard clauses

The IDTA and the Addendum have been proposed by the Information Commissioner’s Office (ICO) as a post-Brexit replacement for the European Commission’s old SCCs which are currently used as a tool to transfer personal data from the UK to third countries that do not offer an adequate level of data protection in compliance with UK GDPR. The new documents were issued under Section 119A of the Data Protection Act 2018 and follow a consultation held by the ICO last year. Read our previous blog on this development.

The IDTA and Addendum take account of the European Court of Justice’s decision in the case of Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (C-311/18) (Schrems II). The judgment requires that when transferring personal data to a third country, data controllers and processors relying on the SCCs must assess whether the law or practice of the third country diminishes the protections afforded in the SCCs, and where this is the case, put supplementary measures in place to ensure protection of personal data. The European Commission adopted an updated set of SCCs on 4 June 2021, which take into account the Schrems II decision. For more information on the approach taken by the EU, please see our articles here and here.

Transitional provisions

The ICO has confirmed that although the IDTA and the Addendum will enter into force on 21 March 2022, subject to Parliamentary approval, they are of immediate use to organisations.  

The transitional provisions set out that organisations can rely on the old SCCs for contracts concluded on or before 21 September 2022 until 21 March 2024, provided that the processing operations that are the subject matter of the contract remain unchanged and reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards. 

ICO guidance

On 31 January 2022, the ICO announced that they are developing additional tools to provide support and guidance for organisations, including clause by clause guidance on the IDTA and the Addendum, and guidance on how to use the IDTA and carry out transfer risk assessments. The ICO guide to UK GDPR has been updated to add clarification on what can be defined as a restricted transfer. 

Read the press release on 'International data transfer agreement and addendum and transitional provisions laid before Parliament' and the IDTA, the Addendum and Transitional provisions, along with brief ICO guidance. Look out for further commentary on the UK’s IDTA and addendum on our Digital Hub.