The UK government has finally published the UK’s own standard form international data transfer agreement (UK IDTA) for transferring personal data outside the UK to countries not deemed to have adequate data protection regimes. It has also published a standard form international data transfer addendum to the revised EU SCCs (EU SCC UK Conversion Addendum) which allows use of the revised EU SCCs for export from the UK.
These documents have been laid before the UK parliament and will come into force on 21 March 2022 unless parliament raises objections. The ICO’s website says that they “are immediately of use to organisations transferring personal data outside of the UK, subject to the caveat” that parliament might change them or not approve them.
UK exporters may use the UK IDTA or the EU SCC UK Conversion Addendum for new exports following 21 March 2022 unless another export route such as BCRs or a derogation are available. Exports that were already underway using a compliant UK contractual export mechanism under the transitional rules (most commonly, the old EU SCCs) and where the processing operations remain unchanged will have to be updated before 21 March 2024.
Although unlikely, there is no guarantee the UK parliament will approve or refrain from modifying the documents; so it would appear that the real start date for use of these documents will likely be 21 March 2022. In most cases, for organisations exporting from the UK and EU, the EU SCC UK Conversion Addendum will be most appropriate and are drafted so that they can be used for exports from both jurisdictions simultaneously. It should be noted that the ICO will provide guidance on how to use these documents in due course and it may therefore be sensible to await such guidance before using them.