In our previous post here we discussed the ICO’s announcement that it is working on new Standard Contractual Clauses (SCCs) to facilitate transfers of personal data outside the UK. The new UK SCCs will be known as the UK’s International Data Transfer Agreement (IDTA).

The ICO has now launched the public consultation on its IDTA and accompanying guidance (available here). The consultation is open for feedback until 5pm on 7 October 2021.

Purpose of the IDTA

The IDTA will replace the current UK SCCs. The ICO has already made it clear that any transfers to third countries will need to take into account the Schrems II decision and apply supplementary measures, where required. The IDTA is a contract which organisations will be able to use when making a ‘restricted transfer’. The ICO is also consulting on how to define a ‘restricted transfer’ in light of the UK GDPR. In particular, the ICO is consulting on whether to keep its current guidance that says a restricted transfer only takes place where the importer’s processing of the personal data is not subject to UK GDPR. Recognising the complexity of international transfers for businesses, the ICO Executive Director of Regulatory Strategy, Steve Wood, has said that the new guidance is designed to be accessible and to support the full range of organisations, from SMEs to multi-national companies.

The consultation

The consultation is split into three sections, including:

  1. Proposal and plans to update its guidance on international transfers;
  2. Transfer risk assessments (TRA). The ICO outlines a TRA tool consisting of three steps designed to assist organisations making routine restricted transfers. The TRA tool provides a list of questions to work through and tables to help the organisation assess the risk at each step.
  3. The international data transfer agreement and a helpful addendum that can be used with international data transfer agreements issued by other jurisdictions including the EU, New Zealand and the Association of Southeast Asian Nations.

Next steps

The ICO has encouraged all organisations that undertake international transfers and other interested parties such as data protection practitioners and legal professionals to engage with the consultation and provide feedback. All of the feedback received will inform the ICO’s work in developing the final documents and help to ensure that the final version of the transfer tools work effectively in practice.

If you are interested in responding to the consultation you can download and complete the consultation paper and questions document from the ICO’s website here and email IDTA.consultation@ico.org.uk. Keep an eye out for our future blog posts where we will report on the final documents.