Businesses will no doubt be aware that they cannot transfer personal data to countries outside the UK (a third country) without ensuring that certain safeguards are in place.
If a recipient is located in a third country and that third country is deemed to provide an adequate level of protection, the UK based business will be free to transfer data to the recipient. However, if the recipient is located in a third country which is not deemed to provide an adequate level of protection, the exporting business will have to implement other safeguards which are most likely to take the form of the EU’s standard contractual clauses (“EU SCCs”).
The UK Parliament has approved a new international data transfer agreement (the “IDTA”) and an international data transfer addendum (the “UK Addendum”) to the new EU SCCs.
UK businesses can now choose whether to use the IDTA or the UK Addendum as a basis for transferring data to a third country.
What is the IDTA?
The IDTA is a mechanism which safeguards the transfer of personal data to a third country. The IDTA replaces the old EU SCCs and can be used as a standalone agreement to facilitate the transfer of personal data to a third country where is subject to UK data protection legislation.
What is the UK Addendum?
The UK Addendum is an alternative method of transferring data to a third country. The UK Addendum supplements the new EU standard contractual clauses. This may be the preferred method for international businesses that are already making use of the new EU standard contractual clauses and are subject to both UK and EU data protection legislation.
Dates to Note
Businesses should note the following:
- for new contracts requiring a transfer of personal data from the UK to third countries, the old EU SCCs can only be used until 21 September 2022, at which point any new data transfers must be based on the IDTA or the UK Addendum; and
- for existing contracts involving transfers of personal data from the UK to third countries, businesses have until 21 March 2024 to replace any old EU SCCs with the IDTA or the UK Addendum.
Moving forward, businesses should review their arrangements for data transfers to third countries and start proactively updating their agreements to ensure that the correct mechanism is implemented in advance of the relevant key dates.
Get in touch
If you would like to discuss any of the issues raised in this article, or you would like assistance with your compliance with UK GDPR, Rebecca Anforth (Legal Director), would be delighted to hear from you. You can reach Rebecca on 07984692100 or you can email her rebecca.anforth@murrellassociates.co.uk.
The information provided in this article is a summary for general information purposes only and does not constitute legal or other professional advice and cannot be relied on as such. Any law quoted in this article is correct as at the above date. Appropriate legal and financial advice should be sought for specific circumstances before any action is taken.
