The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

On 2 February 2022, the Secretary of State laid before Parliament the international data transfer agreement (IDTA), the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions. This final step followed the consultation the ICO ran in 2021. The documents were issued under Section 119A of the Data Protection Act 2018 and following Parliamentary approval came into force on 21 March 2022.

Exporters can use the IDTA or the Addendum as a transfer tool to comply with Article 46 of the UK GDPR when making restricted transfers.

The IDTA and Addendum replaced standard contractual clauses for international transfers. They take into account the binding judgement of the European Court of Justice, in the case commonly referred to as “Schrems II”.

These documents are immediately of use to organisations transferring personal data outside of the UK:

The IDTA and Addendum form part of the wider UK package to assist international transfers. This includes independently supporting the Government’s approach to adequacy assessments of third countries.

We consulted on our approach to international transfers under UK GDPR from 11 August 2021 to 11 October 2021. When finalising the documents we considered the detailed responses we received and will be publishing these soon.

In our Guide to UK GDPR we have added clarification as to what is a restricted transfer. We are developing additional tools to provide support and guidance to organisations. These will be published soon.

  • Clause by clause guidance to the IDTA and Addendum.
  • Guidance on how to use the IDTA.
  • Guidance on transfer risk assessments.
  • Further clarifications on our international transfers guidance.