UK GDPR – A new UK personal data transfer mechanism

Estimated reading time 3 minutes

What’s new?

Eight months after the EU released their new standard contractual clauses for personal data transfers outside of the EEA, the UK Information Commissioner’s Office (ICO) issued its version of the new standard contractual clauses (SCCs).

Why?

Following Brexit, the new EU SCCs did not come into effect in the UK. The UK needed to implement updated SCCs under its own domestic legislation – the UK GDPR. Until this release by the ICO, the old SCCs had been implemented under superseded directives and required amendments due to case law.

What do I need to do?

Article 46 of the UK GDPR imposes a requirement to provide appropriate safeguards when transferring personal data outside of the UK to countries not covered by ‘adequacy’ requirements. When such an export takes place, organisations can choose to use either the:

• International data transfer agreement (IDTA) – this is a freestanding personal data transfer agreement designed for transfers outside of the UK to non-adequate countries for those businesses that are not using the EU SCCs (for example, a transfer from a UK entity to a processor in the US); or the
• UK addendum – for organisations that use the new EU SCCs, this is an add-on to fold-in UK data flows to the EU SCCs. Multinational companies subject to both the EU GDPR and UK GDPR will choose this option for their global data transfers (internal and external).

When?

• The new transfer arrangements come into force on 21 March 2022.
• Until 21st September 2022, new personal data transfers can continue using the old SCCs.
• From 21st September 2022, new arrangements should migrate to the updated SCCs.
• Existing arrangements using the old SCCs must be replaced by the 21March 2024.

Find out more

This article was produced by Megan Shields, Partner, at Abbiss Cadres, England, UK, a CELIA Alliance member firm. For further information or if you have any queries relating to the content of this communication, please contact us. CELIA Alliance CELIA Alliance members are identified here. Members of the CELIA Alliance are each independent law firms and do not practice law jointly with any other member of the CELIA Alliance. "CELIA Alliance" and "CELIA" are not trading names. For more information about the CELIA Alliance click here. Disclaimer Content is for general information purposes only. The information provided is not intended to be comprehensive and it does not constitute or contain legal or other advice. If you require assistance in relation to any issue please seek specific advice relevant to your particular circumstances. In particular, no responsibility shall be accepted by the authors or by Abbiss Cadres LLP for any losses occasioned by reliance on any content appearing on or accessible from this newsletter. For further legal information click here. Circular 230 disclosure To ensure compliance with requirements imposed by the IRS and other taxing authorities, we inform you that any tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties that may be imposed on any taxpayer or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. Copying If you would like to copy or otherwise reproduce this article then you may do so provided that: (1) any such copy or reproduction is for your own personal use or if it is made available to any third party it is done so on a free of charge basis; and (2) the article is reproduced in full together with the contact details, disclaimer and any logos as they appear on each article.