UK introduces new data transfer regime with the IDTA and IDTA Addendum

What does the introduction of the IDTA, the IDTA Addendum and the transitional provisions being laid before Parliament mean for data transfers between the UK and Europe?

The key takeaway

The UK’s Information Commissioner’s Office (ICO) has now laid down before Parliament the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU SCCs (Addendum) and a document setting out transitional provisions. These documents have been released to replace the existing standard contractual clauses (Old SCCs) used for data transfers from the UK to third countries to comply with Article 46 of the UK GDPR. Unless opposed, the documents will come into force in the UK on 21 March 2022 and will be able to be used immediately. The transitional provisions provide that organisations can rely on the Old SCCs for contracts concluded on or before 21 September 2022 until 21 March 2024, save that the processing operations under the relevant contract must remain unchanged and the transfer of the personal data is subject to appropriate safeguards.

The background

The ICO launched a consultation in October 2021 on how organisations can continue to protect people’s personal data when they are transferred outside of the UK, specifically focussing on responses to their draft IDTA and related guidance. The IDTA was set to replace the Old SCCs while enabling the maintenance of high standards of data protection for people’s personal information when being transferred outside of the UK.
The development

The IDTA provides appropriate safeguards for restricted transfers to countries outside of the UK. It also seeks to incorporate requisite “supplementary measures” to protect personal data being sent to countries which would not otherwise provide adequate data protection following the decision in Schrems II. 

The Addendum, on the other hand, can be used by multi-national organisations in the EEA and UK in conjunction with the new EU SCCs that the Addendum amends for the UK context. This provides an alternative to the IDTA, so that the new SCCs can be used for transfers from the UK in the same way as the Old SCCs. 

Both documents, therefore, enable multi-national companies to use one transfer regime for transfers outside of the EEA without the need for the negotiation of several different regimes. 

The documents are set to come into force on 21 March 2022. If any organisations are still using the Old SCCs in agreements entered into before 21 September 2022, they can continue to do so until 21 March 2024, following which the new documents will become mandatory. 
The ICO will publish further supporting documentation to assist organisations in navigating these new arrangements. This should include explanatory notes for both the IDTA and the Addendum.

Why is this important?

The IDTA and the Addendum will be a cornerstone for organisations to validate their data transfers from the UK to third countries. Since the Old SCCs will fall away by latest March 2024, it is important for companies to start looking carefully at the new documents against their existing data transfer regimes to ensure compliance in the future. 

Any practical tips?

UK businesses will need to work out which of the IDTA or the Addendum is the best solution for them. Businesses with operations only in the UK may choose the IDTA, but those with an EU presence should look to the Addendum as this will maintain consistency with their other EU offices. Steps to take now include:

• keep a close eye on ICO guidance on the practical implementation of the IDTA and the Addendum
• work out which mechanism is best for your business, noting in particular the location of any international offices, and start planning now on how to get key stakeholders in the business engaged with the new requirements
• diarise the 22 September 2022 cut-off date – from then on, your agreements must use either the IDTA or the Addendum.