The ICO publishes final versions of the International Data Transfer Agreement and a new Standard Contractual Clause Addendum

A new Standard Contractual Clause Addendum (SCC Addendum) has also been published, which will also come into force on 21 March 2022. Please see here for copies of the documents. How does the IDTA work? The IDTA is a tool to safeguard transfers of personal data from the UK to countries which are not covered by an adequacy decision. The IDTA is separate to the new EU Standard Contractual Clauses published by the European Commission last year. The IDTA can be used for any transfers from the UK by a controller or a processor. What is the SCC Addendum? To simplify data transfer documentation, the ICO has also published an addendum which can be used alongside the new EU Standard Contractual Clauses. This may be the preferred method for international organisations already making use of the new EU Standard Contractual Clauses as the SCC Addendum can be added to the existing agreement to cover transfers from the UK. How the IDTA and SCC Addendum are to be used As with the old EU Standard Contractual Clauses, the IDTA and SCC Addendum cannot be amended but they do provide space for the inclusion of additional terms to cover extra protections that may be required following the Schrems II decision. The IDTA also includes a user-friendly front sheet which is to be populated with the particular details for the relevant transfer. We are shortly expecting the ICO to publish full guidance on the use of these documents and to also provide greater clarity on its existing international transfers guidance. When can the IDTA and Addendum be used? The IDTA and SCC Addendum can be used from 21 March 2022 but we note that:

• For new contracts featuring transfers from the UK to other countries not covered by an adequacy decision, there is a long-stop date of 21 September 2022 for the IDTA or SCC Addendum to be used (as applicable).
• For existing contracts concerning transfers from the UK, organisations have until 21 March 2024 to replace any old EU Standard Contractual Clauses with the IDTA or the SCC Addendum (as applicable).

It is also worth highlighting that any contracts comprising data transfers from the EEA to “third countries” and which make use of the old EU Standard Contractual Clauses, must be updated to the new EU Standard Contractual Clauses by no later than 27 December 2022. What do you need to do? Nothing needs to be done immediately, but if your organisation shares significant amounts of data outside of the UK, replacing the old EU Standard Contractual Clauses may be a considerable task. Organisations should therefore review its arrangements for international transfers and ensure they are ready to update these arrangements, where necessary, ahead of the deadlines set out above. For further information please contact sophie.wilkinson@onsidelaw.co.uk          roisín.cregan@onsidelaw.co.uk