On Friday 28 January 2022, the ICO’s new data transfer agreement (UK IDTA), and the international data transfer addendum (the UK Addendum) to the European Commission’s standard contractual clauses (EU SCCs) for international transfers were presented to the UK parliament and, subject to any amendments requested by the UK parliament, which is unlikely, they will enter into force from 21 March 2022.

What does this mean?

• From 21 March 2022 a business (or other entity) wishing to transfer personal data from the UK only to the RoW (‘rest of world’) may elect to use the ICO’s UK ITDA – which in some respects is more user-friendly (or at least digestible) than the EU SCCs.
• From the same date, a business (or other entity) wishing to transfer personal data from the UK and the EU to the RoW may use the UK Addendum in combination with the EU SCCs.
• For those businesses with existing agreements in place for the transfer of personal data from the UK and the EU to the RoW, the final ‘missing piece of the jigsaw’ is now in place and they may want to get on and update their data transfer agreements (including intra-group data transfer agreements).
• However, there is certainly no need to rush into things as there is a transition period:
  • If a business currently relies on the old SCCs to transfer personal data from the UK to the RoW, it may continue to do so until 21 March 2024.
  • Equally, for businesses that still want to enter into new agreements on the basis of the old EU SCCs (for example, because they form part of a business’ standard terms etc.), they may continue to enter into new contracts on the basis of the old EU SCCs until 21 September 2022.

For further information or advice on the UK IDTA or data transfers in general, please contact Jonathan McDonald, Jonathan.McDonald@crsblaw.com, the partner who leads the Data Protection and Privacy practice group at Charles Russell Speechlys.