Personal Data Transfers and the Standard Contractual Clauses

The UK Government has designated a number of such countries by way of ‘Adequacy’ regulations (‘adequacy’ effectively meaning that their laws provide adequate protection for personal data), which include all EU member states, EEA members, and Switzerland and Canada amongst others, plus more recently the USA in certain circumstances (so-called ‘partial adequacy’). If a UK data exporter is to transfer personal data to a data importer in a country which has the benefit of an Adequacy regulation then the data exporter does not need to do anything more than it would do if it transferred the data to another business in the UK i.e. it needs to put in place the usual UK GDPR compliant data sharing agreement or data processing agreement depending on whether the other business is a data controller or a data processor.

if the UK data exporter is to transfer personal data to a data importer in a country which does not have the benefit of an Adequacy regulation, then the data exporter needs to use one of the ‘transfer tools’ listed in Article 46 of the UK GDPR. Those transfer tools include:

• The Standard Contractual Clauses (SCCs): A UK Addendum to the EU SCCs may be used to supplement the new EU SCCs. A UK data exporter may elect to use the new EU SCCs with the UK Addendum as an alternative to the IDTA, and in practice it will need to do so where UK data transfers occur alongside EU data transfers.
• The International Data Transfer Agreement (IDTA): Despite its name, the ITDA is the UK’s own post-Brexit version of the SCCs. The IDTA, like the new EU SCCs, requires more specific information about security arrangements and supplementary measures to protect personal data than was needed under the old SCCs. However, the IDTA is a single ‘one-size fits all’ agreement as against the ‘modular’ structure of the new EU SCCs where each relationship (e.g. controller-controller transfer) has its own ‘module’.

The SCCs are presently the most commonly used transfer tool. They have the advantage of being ‘ready-made’ with only limited factual content required to be completed, which reduces both the time involved and the level of negotiation between the parties; they can be used for both controller-controller and controller-processor transfers; and they can be used regardless of the commercial relationship between the data exporter and the data importer and whether or not they are legally connected parties.

The European Commission approved new EU SCCs in June 2021 and the UK Addendum to the new EU SCCs has been available for use since March 2022.

By way of transitional arrangements, UK data exporters were able to continue to enter into new contracts on the basis of the old EU SCCs until September 2022, and to continue to rely on those contracts, and on any pre-existing contracts made on the basis of the old EU SCCs, to provide appropriate safeguards for the purposes of the UK GDPR, until 21^st March 2024.

But it is important to note that data exporters still transferring personal data on the basis of the old SCCs must have new arrangements in place by 21^st March 2024 – either by using the UK Addendum to the new EU SCCs, or by using the IDTA, or by switching to one of the other transfer tools.

The IDTA is likely to become the preferred option for those UK data exporters which have a UK establishment only and which only process personal data to which the UK GDPR applies and therefore are not concerned with EU GDPR compliance, but it is important that whatever new arrangements are to be made are completed and in effect by 21^st March 2024.