Privacy Map

United Kingdom. Data localisation / cross-border. Standard data protection clauses (s.119A DPA 2018)

IDTA / UK AddendumInternational Data Transfer Agreement (IDTA) and International Data Transfer Addendum to the EU Standard Contractual Clauses

In force
Partly verifiedMedium confidence. Dates from ICO guidance known prior; ICO has signalled possible updates to transfer tools following DUAA.

§1Summary

Synopsis

The UK's standard contractual safeguards for restricted transfers under UK GDPR Art 46: a standalone IDTA, or an Addendum that adapts the EU 2021 SCCs for UK transfers. They are used with a transfer risk assessment.

Key themes
  • restricted transfers
  • standard clauses
  • transfer risk assessment
  • processor-to-subprocessor
Unique features

The Addendum lets one EU SCC set cover both EU and UK transfers; the ICO's TRA tool is more flexible than the EDPB's approach.

SaaS relevance

A SaaS provider sending UK personal data to a non-adequate country (including US sub-processors not on the Data Bridge) normally signs the IDTA or Addendum with customers and sub-processors.

§2Obligations

Cross-border transfers
Art 46 appropriate safeguard
Maximum penalty
Breach enforced via UK GDPR

§3Dates

Key dates
  • Adopted
  • In force
  • Laid before Parliament 2022-02-02; in force 2022-03-21; old EU SCCs usable for new contracts until 2022-09-21 and for existing contracts until 2024-03-21; remain valid after DUAA transfer reforms (2026-02-05)

§4Text and authority

Text
Authority
Information Commissioner's Office (ICO)

§5Where it applies

Domestic law of
United Kingdom

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Dates from ICO guidance known prior; ICO has signalled possible updates to transfer tools following DUAA.