On 2 February 2022, the Secretary of State laid before Parliament the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (SCCs) for International Data Transfers (Addendum) and a document setting out transitional provisions. This final step follows the consultation the ICO ran in 2021. The documents are issued under Section 119A of the Data Protection Act 2018.

If no objections are raised, the new documents will come into force on 21 March 2022. Exporters will be able to use the IDTA or the Addendum as a transfer tool to comply with Article 46 of the UK GDPR when making restricted transfers.

The IDTA and Addendum replace the current SCCs for international transfers. They take into account the binding judgement of the CJEU in “Schrems II”.

The ICO says that organisations transferring personal data outside of the UK can use these documents immediately, subject to the caveat that they come into force on 21 March 2022 and are awaiting Parliamentary approval.

The ICO consulted on its approach to international transfers under UK GDPR from 11 August 2021 to 11 October 2021. When finalising the documents it considered the detailed responses received and says that it will be publishing these soon.

The ICO has also added clarification as to what is a restricted transfer to its Guide to UK GDPR and is developing additional tools to provide support and guidance to organisations. These will be published soon:

• clause-by-clause guidance to the IDTA and Addendum;
• guidance on how to use the IDTA;
• guidance on transfer risk assessments; and
• further clarifications on its international transfers guidance.

For links to all the documents, click here.