Own a business? Update on international data transfer agreements

Does your organisation transfer data internationally?  If so, don't miss the 27 December deadline to remain compliant with UK data protection laws.

Open laptop signifying international data transfer agreements and EU Standard Contractual Clauses.

Have you heard news of a 27th December 2022 deadline?  Maybe something about updating your EU SCC documents?  Announcements of a new ‘ITDA’ and an ‘ICO UK Addendum’?  Mutterings of ‘old SCCs’ and ‘new SCCs’?  Well, read on and let us unravel the international data transfer changes.

What actually is an EU SCC document?

This stands for the EU Standard Contractual Clauses, which is an EU approved document which allows for international transfers of personal and special category data from a company within the UK or EU to countries outside of the UK/EU.  It’s a document that requires the overseas transferee of personal data to process it lawfully, safely, securely and in compliance with the various data protection rules that exist.

Does this apply to me?

If you are a company that transfers data to other companies or group entities, who are based in a country outside of the UK/EU, and if that country is not covered by the ‘adequacy regulations/requirements’, then you need to take note.  There have been changes to the documents you need to make complaint international data transfers.  You may ask, what does this actually mean?  What are the adequacy regulations, what are international data transfers? This guidance explains all.

What are the adequacy regulations/requirements?

Under UK data protection laws, you may not make a transfer of personal/special category data to another country if that country is located in a country which is not covered by the UK ‘adequacy regulations’.   Countries covered by the adequacy regulations have been deemed by the UK as having legal frameworks that provide adequate protection in respect of individuals’ data protection rights.

If the adequacy regulations do not apply, then you need to consider whether to put in place other appropriate safeguards instead – such as an approved data transfer agreement.  This can be the use of EU SCCs (with a UK Addendum) or a new UK International Data Transfer Agreement.

More information on ‘adequacy’ can be found on the Information Commissioners website here.

But we left the EU…right?

Yes, since Brexit the UK is no longer a member of the EU.  However, UK companies that have already signed up to EU SCCs can still rely on them.  However, it depends on what version of the EU SCCs you have in place.

If you signed the old EU SCCs (2010 version), then you need to either:

(1) enter into a new EU SCC (2021 version) together with the new UK Addendum (which makes amendments to the standard EU SCC to ensure it is relevant to the UK); or

(2) you can enter into a new UK specific International Data Transfer Agreement (also known as the ITDA).

What is the 27th December 2022 deadline all about?

Under the transition period for the new EU SCCs, which were introduced in 2021, replacement of existing old EU SCCs to the new EU SCCs must be completed by 27 December 2022 for all data transfers.  After this date the old EU SCCs won’t have any legal effect, and any data transfers will not be compliant with data protection law.

What is the difference between an old and new EU SCC?

The old EU SCCs are based on the 2010 version and the new ones are dated 2021.  Depending on which version you already have in place will determine what action you need to take.  The following table applies to UK entities making transfers outside of the UK/EU to a country which does not meet the adequacy requirements:

 I have an old (2010) EU SCC in placeYou need to replace this with a new 2021 EU SCC before 27th December 2022
 I have a new (2021) EU SCC in place You need to prepare a UK Addendum to sit alongside your existing EU SCC.
I don’t have any international data transfer agreements in place but I transfer data out of the UK to a country not covered by adequacy requirementsYou have two options:

  1. Enter into the new International Data Transfer Agreement; or
  2. Enter into the new EU SCC with an UK Addendum attached.

What’s the difference between all these documents?

The EU SCC is the EU-approved standard document for international data transfers.

The UK Addendum is a document that UK companies can use alongside the EU SCCs to make it compliant with UK data protection laws (now that the UK has left the EU).

The International Data Transfer Agreement is a document that UK companies can opt to use instead of the new EU SCC / UK Addendum combination.  It is a standalone agreement that can be used in the same way as the EU SCCs.  It has been drafted (by the ICO) specifically for transfers of data from the UK and ensures compliance with the UK GDPR.  This document simply places contractual obligations on organisations exporting data to another organisation in a different jurisdiction.

What should we do?

Well, it depends on whether you are already using EU SCCs or whether you are entering into an international data transfer agreement for the first time.  Generally, organisations that already have the new EU SCCs in place are using the UK Addendum to align their documents with UK laws.  For organisations with no historical documents in place, then companies are opting for the new UK International Data Transfer Agreements – one document is easier to manage!

Another factor is whether you are based in the UK and other EU countries.  If your group has entities in the UK and other EU countries, then it might be simpler to adopt the EU SCC / UK Addendum option.  If you are only based in the UK (with no plans to expand into EU countries), then the UK International Data Transfer Agreement would be preferable.

Still confused?

Take a look at the guidance issued this month by the ICO on international transfers (found here (International transfers | ICO).  They have also prepared a Transfer Risk Assessment guidance,  and a TRA Tool.  These resources from the ICO will help organisations work out the steps they need to take and the documents that should be put in place to stay the right side of data protection laws.

Feel free to reach out if you need an audit of your international data transfer agreements.  Equally, if you have a supplier asking you to enter into a new data transfer agreement and you want to check it’s the right one, then we can do a health check on the agreement for you.  We can analyse what you have in place and advise you on the neatest way to seek compliance… and all before the 27th December deadline!

Clare Veal is a Consultant Solicitor in our Commercial Department and has been advising companies on their data protection requirements through all the evolutions of GDPR and UK data protection laws.

This article was written by Clare Veal

Please note the contents contained in this article are for general guidance only and reflection the position at time of posting. Legal advice should be sought before taking action in relation to specific matters.

More Articles

Employment Law: Do you know the changes?

The 6th of April 2024 marked a significant date for employment law changes...

Written by Omar Qassim

How will the court deal with business assets on divorce?

When considering finances on a divorce, particular attention should be given to the...

Don’t let cybercrime catch you out

We’ve all heard of cybercrime, or crimes that take place by means of...

Written by Ema Bryn Jones

Find out how we can help you


© Peacock & Co 2024. All Rights Reserved.

Peacock & Co is authorised and regulated by the Solicitors Regulation Authority.