As of today 21 September 2022, where you are a undertaking an international transfer from the UK where a transfer mechanism is requirement, all new arrangements and any existing arrangements where there is a change in the processing will be required to use either:
- The UK International Data Transfer Agreement (IDTA) – which is a standalone agreement; or
- The UK Addendum to the EU Standard Contractual Clauses (UK Addendum) – which amends the new EU Standard Contractual Clauses (New EU SCCS) for use in the UK,
to govern such transfers.
By way of reminder a transfer mechanism will be required where data is being sent from the UK to a jurisdiction which has not been deemed adequate by the UK government. This currently includes all EEA countries and all countries deemed adequate by the European Commission prior to Brexit taking effect.
Therefore, you should ensure that going forward :
- all new agreements contain either the IDTA or UK addendum (consider updating your templates if you have not already done so); and
- ensure you have a process to identify changes to existing arrangements which necessitate a move to the IDTA or UK addendum.
Ensuring Compliance of Existing Agreements
As well as ensuring organisations have appropriate transfer risk assessments (TRAs) in place, it should also be noted that for existing agreements made before 21 September 2022 which use the old EU SCCs (which remained valid in the UK after Brexit), these EU SCCs will only be valid until 21 March 2024, at which point they will need to be replaced by either the IDTA or the UK Addendum. Therefore organisations have 18 months to complete their remediation projects of their UK transfers.
It is also worth noting that where businesses undertake both EEA transfers as well as UK transfers, the deadline for remediation to the New EU SCCs for EEA transfers of all agreements using the old EU SCCs is 27 December 2022, with the New EU SCCs having been mandatory for new (and amended) transfers from 27 September 2021.
We await ICO guidance on the application of these two new instruments (which had been promised for September) as well as its finalised TRA guidance and further analysis of this guidance will follow upon its release.
To discuss your approach to remediation and international transfers more generally please do get in touch.
