Search

How can we help?

Icon

Guide to the International Data Transfer Agreement

For organisations that transfer personal data from the UK to other jurisdictions, new data sharing agreements are now in force.

The ICO’s International Data Transfer Agreement (IDTA) is another step along the way to greater clarity, after the upheavals of Brexit and the landmark European privacy ruling, Schrems II. 

What is the International Data Transfer Agreement?

The IDTA is the UK’s version of standard contractual clauses (‘SCCs’) – a form of data sharing agreement used to legally allow the transfer of personal data to a country outside of the scope of GDPR (a restricted transfer).

Post-Brexit, the ICO adapted EU SCCs for a UK context. The IDTA now replaces those amended SCCs (old SCCs) – giving the UK its own template international data sharing agreement.

The agreement ensures the personal data that is transferred continues to receive a similarly high level of protection, as required by the restricted transfer rules.

When should an International Data Transfer Agreement be used?

Some countries are covered by adequacy regulations – meaning they are judged by the UK to have sufficiently similar data protection standards to those under UK GDPR. 

Data can flow freely between the UK and these countries, such as EEA countries (a reciprocal EU adequacy decision exists for the UK under EU GDPR). A normal, commercial data sharing agreement will be enough in those circumstances.

An IDTA will be the right agreement to use where:

  • New data sharing arrangements are being finalised after 21 March 2022; 
  • To transfer personal data outside of the UK; and
  • There is no adequacy regulation in place for the location the data transfer is being transferred to, e.g., the US.

Eventually, all data transfer sharing agreements based on EU SCCs will need updating – but the deadlines depend on when the agreements were signed and where the personal data is being transferred from.

Do existing agreements need updating?

Eventually, all data sharing agreements based on EU SCCs will need updating – but the deadlines depend on when the agreements were signed and where the personal data is being transferred from.

In 2021, the EU updated its SCCs – and some entities that transfer data from both the UK and EEA to other parts of the world should be using these ‘new SCCs’ if they concluded their arrangements after 27 September 2021.

This means:

  • For transfers from the UK only under agreements signed on or before 21 September 2021 (using old SCCs including those modified for the UK context after Brexit) – arrangements need to be documented in IDTA format by 21 March 2024.
  • For transfers from the UK and EEA under agreements signed before 27 September 2021 (using old SCCs), arrangements will only be valid until 27 December 2022 and should be transferred to the new EU SCCs and Addendum (see below).
  • For transfers from the UK and EEA under agreements signed on or after 27 September 2021 (using new SCCs), the ICO has also produced an Addendum which enable the new SCCs to work with the UK data protection regime.

How do International Data Transfer Agreements work?

The IDTA format is similar to the old SCCs, and includes the following:

  • Tables to set out specific information about the exporter, the importer and the restricted transfer;
  • The option to include extra protection clauses; 
  • The option to include commercial clauses agreed by the exporter and importer, provided that these do not contradict the agreement; and
  • A set of mandatory clauses, which must always be included, including a Legal Glossary.

The IDTA takes into account some criticisms of the US data protection regime in the Schrems II judgment, so it offers slightly more protection than the old SCCs. But using an IDTA doesn’t take away the new Schrems II requirement to also additionally risk assess transfers to the US (and other jurisdictions where there is no adequacy regulation). 

The ICO consulted on a risk assessment tool to help data exporters with this process – they are available in draft form but have yet to be finalised. The ICO is expected to finalise this and other international transfer guidance during 2022.

Our data protection team can be contacted for further information and support.

About this article

Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

About this article

Read, listen and watch our latest insights

art
  • 09 December 2024
  • Corporate and M&A

UK Directors’ Responsibilities

On becoming a director of a company, directors undertake to comply with various duties and responsibilities. which are specified in the Companies Act 2006. In this article, we will explain how you can comply with these practical responsibilities.

art
  • 09 December 2024
  • Commercial Real Estate

What happens to a sublease when the headlease is surrendered, forfeited or disclaimed?

The intermediate tenant under the headlease falls away and the tenant under the sublease becomes the direct tenant of the superior landlord.

art
  • 09 December 2024
  • Employment

Mistletoe and Missteps: Preventing Harassment at Christmas Parties

As the festive season approaches, offices are coming together for their annual Christmas parties, offering a chance to unwind and celebrate the year’s achievements. However, whilst these events provide a necessary release and recognition of employee’s contributions, they also present a heightened risk of inappropriate behaviour, particularly sexual harassment.

art
  • 03 December 2024
  • Immigration

UPDATE – Ministers to postpone full eVisa rollout amid fears of UK residents being stranded abroad

The UK government will postpone the full transition to eVisas, initially planned for 1 January 2025, following concerns that system glitches could leave UK residents stranded abroad.

art
  • 02 December 2024
  • Litigation and dispute resolution

The Era of AI

In this recent case, the First-Tier Tribunal gave a stark warning to litigants about use of AI in litigation.

art
  • 28 November 2024
  • Employment

Employment Rights Bill: The Regulatory Policy Committee opinion

This article considers the Regulatory Policy Committee’s recently published opinion on the impact assessments for the Employment Rights Bill. The Committee assessed the quality of evidence and analysis used to inform the government proposals and came to the overall opinion that the impact assessments are currently “not fit for purpose”.