International data transfer agreement (IDTA) now in force
The new international data transfer agreement (IDTA) and addendum came into force on 21 March 2022, designed to be used by those importing and exporting data from the UK, also giving confidence that data transfers are compliant with Article 46 of the UK GDPR when making restricted transfers.
Prior to this, the only effective data transfer mechanism for transfers outside of the UK was the standard contractual clauses previously adopted by the European Commission (the old EU SCCs) which were then replaced in June 2021 by the European Commision with new EU SCCs. However once Brexit took place these did not apply in the UK and so the IDTA and addendum is the long-awaited UK equivalent.
The IDTA and Addendum replace standard contractual clauses for international transfers. They take into account the binding judgement of the European Court of Justice [Schrems II] and ensure that all transferred data is governed in accordance with UK data protection laws.
The ICO has more detailed guidance on how and when to use the IDTA and Addendum.
Any UK businesses that have existing contracts that provide for the transfer of personal data to entities based elsewhere in the world will need to have updated any contracts by the 21 March 2024 deadline.
Those transferring data should also note that should any new contracts be agreed between now and 21 September 2022, the 21 March 2024 deadline will also apply where the data transfers provided for in those agreements are underpinned by EU SCCs.
Posted on 05/05/2022 by Ortolan