New law: Organisations face new UK standard contractual clauses to be used to protect personal data they transfer out of the UK

UK organisations cannot transfer personal data to recipients in countries the UK does not recognise as having adequate data protection laws unless they use ‘appropriate safeguards’ to protect that data. One safeguard is to include standard contractual clauses (SCCs), prescribed under UK data protection laws, in the organisation’s data transfer agreement with the recipient.

While the UK was in the EU, it relied on the European Commission’s decisions as to which countries had adequate data protection laws. If a UK organisation was sending personal data to a recipient in such a country, it could use the standard protection clauses prescribed by the EU – the EU SCCs. Now the UK has left the EU, it has introduced its own regime for recognising the adequacy of other countries’ data protection laws, and its own SCCs.

The UK recognises EEA countries (the EU member states, plus Iceland, Norway and Liechtenstein) as having adequate data protection laws. It also continues to recognise those non-EEA countries that the European Commission recognises as adequate, and a limited number of other territories. But the laws in any other country – for example, the USA - are not considered adequate.

Where the UK does not recognise a country’s laws as adequate, it has prescribed its own new SCCs to be used in data transfer agreements with recipients in those countries. These are set out in:

• a new UK-specific International Data Transfer Agreement (IDTA); and
• a new UK Addendum to be used in conjunction with the EU’s existing Standard Contractual Clauses (EU SCCs) for transfers of personal data.

Organisations will need to decide which of these provisions to include in relevant data transfer agreements they enter into, including those dealing with transfers to group companies, suppliers, customers or other third parties.

The choice will depend on whether the organisation is based solely in the UK, so it will be transferring data from the UK only, or whether it will also be transferring personal data from an EEA country – perhaps because it has a branch there - to the non-adequate country.

When deciding which clauses to use, the organisation will need to take account of the differences between the IDTA and the UK Addendum. If it needs more time to decide what to do, there are transitional provisions that allow organisations to continue to use just the EU SCCs in agreements entered into before 21 September 2022, which will be valid until 21 March 2024. After 21 September 2022 they must use the new IDTA or UK Addendum. Organisations may also want to re-negotiate existing data transfer agreements, which already include the EU SCCs in force at the time they were entered into.

The Information Commissioner’s Office (ICO) has promised to publish updated guidance on international data transfers soon, including clause-by-clause guidance on the IDTA and UK Addendum and guidance on how to use the IDTA.

The ICO has also promised new guidance on the UK Transfer Risk Assessment tool, which helps businesses assess data protection risks in non-adequate countries and make the best decision as to which clauses to use.

Operative date

• March 2022

Recommendation

• Organisations that transfer personal data out of the UK to recipients in countries that are not recognised by the UK as having adequate data protection laws need to consider which contractual clauses to include in their data transfer agreements, following the introduction of the new UK standard protection clauses.