Don’t do SECURITY. Do business SECURELY.
Threat intelInsightsBook a consultation
Back to all insights

UK International Data Transfer Agreement and Addendum in force

New UK tools for international transfers of personal data, the IDTA and the UK Addendum to the EU SCCs, come into force.

The ICO’s International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum to the EU Standard Contractual Clauses come into force today.

What this means

  • The IDTA is a standalone UK contract for restricted transfers of personal data out of the UK.
  • The Addendum lets organisations use the 2021 EU SCCs for UK transfers, which is useful where the same data flows cover both EU and UK exports.
  • Contracts concluded before 21 September 2022 on the old EU SCCs remain valid until 21 March 2024, after which they must be replaced.
  • A transfer risk assessment is still needed when relying on these safeguards.

Review your supplier and intra-group contracts and plan the migration well before the 2024 deadline.

Source: International Data Transfer Agreement and guidance (ICO)

This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.

Get our weekly insights by emailA free weekly threat and vulnerability round-up with a link to our threat log spreadsheet, plus legal, regulatory, standards, and AI updates.
Subscribe free

How we can help: consulting, auditing, and AI governance. Book a complimentary consultation.

More insights