The documents are issued under Section 119A of the Data Protection Act 2018.
The Secretary of State has laid before Parliament the international data transfer agreement (IDTA), the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions. This follows the consultation the ICO ran in 2021. The documents are issued under Section 119A of the Data Protection Act 2018.
If no objections are raised, they come into force on 21 March 2022. Exporters will be able to use the IDTA or the Addendum as a transfer tool to comply with Article 46 of the UK GDPR when making restricted transfers.
The IDTA and Addendum replace the current standard contractual clauses for international transfers. They take into account the Schrems II judgement of the Court of Justice of the European Union. The ruling said that standard contractual clauses were valid, but required organisations to carry out further diligence when making a transfer of personal data to countries without an adequacy decision.
The ICO says that the documents can be used immediately by organisations transferring personal data outside the UK. However, organisations need to bear in mind the caveat that they come into force on 21 March 2022 and are awaiting Parliamentary approval:
The IDTA and Addendum form part of the wider UK package to assist international transfers. This includes independently supporting the UK government’s approach to adequacy assessments of third countries.
The documents are here:
The ICO has amended its Guide to the UK GDPR to add clarification about what is a restricted transfer. It is developing additional tools to provide support and guidance to organisations which it says that it will publish soon.