UK - Standard clauses for international data transfers come into force
01 April 2022
Organisations can use the IDTA or the Addendum as a transfer tool to comply with Article 46 of the UK GDPR when making restricted data transfers subject to UK GDPR to non-adequate jurisdictions.
The IDTA and Addendum will replace the existing standard contractual clauses for international data transfers adopted by the European Commission and issued under pre-GDPR Directive 95/46/EC (Directive SCCs), which continued to be valid under UK GDPR following Brexit. You can read the A&O take on final IDTA and Addendum here and detailed analysis of the draft versions here.
The UK Information Commissioner’s Office (ICO) has published an explanatory note to clarify the transitional provisions that apply to the use of Directive SCCs and the implementation of the IDTA or Addendum. In summary:
- From 21 March 2022, the IDTA or Addendum are valid for use under UK GDPR;
- From 21 September 2022, the Directive SCCs can no longer be used in new contracts to legitimise data transfers subject to UK GDPR; and
- On 21 March 2024, the two-year transition period expires. All contracts will need to incorporate either the IDTA or the Addendum for valid data transfers subject to UK GDPR.
The ICO has also updated its online guide to UK GDPR to reflect these changes and has confirmed that it is developing additional tools to provide support and guidance for organisations in relation to international data transfers.
This article was written in collaboration with the aosphere Rulefinder Data Privacy team. Rulefinder Data Privacy is an online legal subscription service which analyses and tracks data privacy obligations globally. Learn more and request a free trial here.