The UK General Data Protection Regulation 2018 (UK GDPR) contains restrictions on international data transfers. Personal data cannot be transferred outside the UK without appropriate measures to ensure that personal data is adequately protected.
The following are deemed appropriate measures by the UK GDPR:
- adequacy decision;
- binding corporate rules;
- approved code of conduct; or
- standard contractual clauses.
Back in March 2022, the Information Commissioner’s Office (ICO) introduced two new types of standard contractual clauses:
- the International Data Transfer Agreement (IDTA); and
- the International Data Transfer Addendum (Addendum) to the new European Commission’s Standard Contractual Clauses (new EU SCCs),
replacing the old European Commission’s Standard Contractual Clauses (old EU SCCs) used by UK data exporters to transfer personal data outside the UK. We discussed the changes here.
The ICO granted a grace period until 21 March 2024 for UK businesses to update their existing data transfer arrangements to use either the IDTA or Addendum to the new EU SCCs. What this means in practice is that any data transfer arrangements utilising the old EU SCCs will need to be updated to use either the IDTA or Addendum to the new EU SCCs to comply with UK GDPR.
Failing to update existing arrangements by the end of the grace period, and continuing to transfer personal data to third countries using the old EU SCCs will result in a breach of the UK GDPR. As a reminder, the ICO has the power to impose fines of up to £17.5 million or 4% of the total annual worldwide turnover (whichever is higher in the preceding financial year) on businesses for non-compliance.
With the deadline fast approaching it is important that businesses identify whether they have existing arrangements in place incorporating the old EU SCCs, and to update those arrangements accordingly.
Please contact David Varney if you would like to discuss your international data transfer arrangements.