Changes to complying with UK GDPR – the new “International Data Transfer Agreement” and the UK Addendum
On 21 March 2022, the Information Commissioner’s Office (‘ICO’) brought into force the International Data Transfer Agreement (‘IDTA’) and UK Addendum (‘Addendum’). These documents replace the current standard contract clauses (‘SCCs’) to comply with UK GDPR in the international transfer of personal data. If an organisation transfers personal data to a third-country which does not have authorised equivalency of UK GDPR protections, any such transfer will be deemed unlawful unless that organisation has entered into one of the new legal arrangements before the end of the relevant transition period, as set out below. The ICO has noted that the IDTA and Addendum are now ready for use, and you can switch over to the new documents to ensure your compliance with UK GDPR when the relevant transition period comes to an end.
Please see the dates below, showing when organisations must have entered into the IDTA or UK Addendum and for how long an organisation may reply upon the old SCCs for UK GDPR compliance.
Summary of the timeline
- 21 March 2022 – The IDTA and UK Addendum came into force
- 21 September 2022 – Companies may continue to enter into the old SCCs until this date
- 22 September 2022 – Companies must rely on the IDTA or the new EU SCCs and UK Addendum
- 21 March 2024 – Contracts entered into before 21 September 2022, with the old SCCs, will remain compliant with UK GDPR until this date (so long as the data processing operations remain the same)
How we can help
For our advice and assistance please contact the Corporate and Commercial Team on info@tsplegal.com or call 01206 574431.