UK - Standard clauses for international data transfers come into force
Browse this blog post
Related news and insights
Blog Post: 14 February 2024
Blog Post: 31 January 2024
Blog Post: 16 January 2024
ICO publishes a UK BCR Addendum for use with EU Binding Corporate Rules
Blog Post: 10 January 2024
Automated decision making is under scrutiny in the EU and how is it addressed in other jurisdictions
Organisations can use the IDTA or the Addendum as a transfer tool to comply with Article 46 of the UK GDPR when making restricted data transfers subject to UK GDPR to non-adequate jurisdictions.
The IDTA and Addendum will replace the existing standard contractual clauses for international data transfers adopted by the European Commission and issued under pre-GDPR Directive 95/46/EC (Directive SCCs), which continued to be valid under UK GDPR following Brexit. You can read the A&O take on final IDTA and Addendum here and detailed analysis of the draft versions here.
The UK Information Commissioner’s Office (ICO) has published an explanatory note to clarify the transitional provisions that apply to the use of Directive SCCs and the implementation of the IDTA or Addendum. In summary:
- From 21 March 2022, the IDTA or Addendum are valid for use under UK GDPR;
- From 21 September 2022, the Directive SCCs can no longer be used in new contracts to legitimise data transfers subject to UK GDPR; and
- On 21 March 2024, the two-year transition period expires. All contracts will need to incorporate either the IDTA or the Addendum for valid data transfers subject to UK GDPR.
The ICO has also updated its online guide to UK GDPR to reflect these changes and has confirmed that it is developing additional tools to provide support and guidance for organisations in relation to international data transfers.
Read the IDTA and Addendum, the Transitional Provisions and the Guide to UK GDPR.
This article was written in collaboration with the aosphere Rulefinder Data Privacy team.* Rulefinder Data Privacy is an online legal subscription service which analyses and tracks data privacy obligations globally. Learn more here.
DISCLAIMER: aosphere ceased to be affiliated with Allen & Overy on 8 February 2024 and is no longer part of the Allen & Overy group. aosphere is a separate business that is not regulated by the Solicitors Regulation Authority. A&O does not receive any referral fees from aosphere.