50 Days to Update Existing Contracts to Address International Data Transfers from the UK

Authors:

Oliver Yaros,
Reece Randall,
Ellen Hepworth,
Alasdair Maher,
Oli Jones,
Trainee Solicitor

Businesses transferring personal data from the UK to countries that are not considered to offer an "adequate" level of data protection should be aware of a key deadline.

From 21 March 2024, data processing agreements and other contracts entered into on or before 21 September 2022 that incorporate the standard contractual clauses adopted by the European Commission in 2001, 2004 or 2010 can no longer be used to ensure compliance with the UK General Data Protection Regulation ("UK GDPR").

Instead, organisations need to update their existing contracts before this deadline to incorporate the International Data Transfer Agreement ("IDTA") or the International Data Transfer Addendum (the "UK Addendum") published by the UK Information Commissioner's Office.

The IDTA is a separate agreement. The UK Addendum is used in conjunction with the new European Commission's standard contractual clauses adopted in June 2021. You can find more information about both documents in our client alert.

Authors

Related Services & Industries

Services

Cybersecurity & Data Privacy

Stay Up To Date With Our Insights

See how we use a multidisciplinary, integrated approach to meet our clients' needs.