Law 365's Microsoft fluent legal experts help Microsoft Partners grow their business through quick, affordable and accessible legal services.

Commercial Legal Services

Our experienced commercial lawyers have got you covered with expert advice, rapid contract review and timely negotiation.

HAPPY 365

Employment services and people development combined to create HAPPY 365 - designed to help you grow a happy workplace.

Top visited contracts and agreements

View our most popular contracts, where we break down legalese, and reveal the FAQs Microsoft Partners are asking us.

Helping Microsoft Partners grow with less risk

Inside the UK's Top Microsoft Partners

Microsoft Partner Insights Front Cover 350 x 483

 

3 min read

UK International Data Transfer Agreement (IDTA) now in force

Featured Image

On 21 March 2022, the new UK International Data Transfer Agreement (“IDTA”) and International Data Transfer Addendum (“Addendum”) came into force, having first been laid before Parliament on 02 February 2022.

Here we break down and tackle the following:

  1. What are the IDTA and Addendum?
  2. When should we use the IDTA?
  3. When should we use the Addendum?
  4. Transfer Risk Assessment or TRA?
  5. When should we use the IDTA and Addendum?

On 21 March 2022, the new UK International Data Transfer Agreement (“IDTA”) and International Data Transfer Addendum (“Addendum”) came into force, having first been laid before Parliament on 02 February 2022.

What are the IDTA and Addendum?

The IDTA and Addendum replace the old EU SCCs; which had remained a valid tool for UK companies to use when transferring UK personal data from the UK to countries deemed ’non–adequate’ aka ‘third countries’.

With the IDTA and Addendum coming into force, the UK position has been updated to provide for an equivalent to the new EU SCCs which came into force in June 2021 but did not apply in the UK post-Brexit. If you’re scratching your head over the EU SCCs, head over to our recent blog.

When should we use the IDTA?

The IDTA is a standalone contract intended for use where only UK personal data is being transferred to a third country and enables parties to take into account the commercial and legal terms agreed in their data processing / services agreements.

When should we use the Addendum?

The Addendum is designed for use as an add-on to the new EU SCCs where UK and EU personal data is being transferred to a third country. In such circumstances, the Addendum makes a number of amendments to the new EU SCCs so that the proposed data transfer works from a UK GDPR perspective (i.e. providing for the ICO as the relevant supervisory authority and UK governing law).

It is expected that the Addendum will be more commonly used than the IDTA by companies operating in the UK and EU as a means of streamlining their contractual processes (including intra-group data transfers) in order to limit the amount of paperwork required for their international data transfers.

Do I need to do a Transfer Risk Assessment?

Whether the IDTA or Addendum is used, companies transferring personal data to third countries have an additional administrative burden of being required to carry out a transfer risk assessment (“TRA”) prior to making any such transfer. The aim of the TRA is for consideration to be given as to whether the IDTA/Addendum provides appropriate safeguards for the proposed international data transfer, or whether additional steps and protections will need to be taken.

NOTE: A copy of the relevant TRA must also be made available to the ICO on request.

When should we use the IDTA and Addendum?

  • From 21 March 2022
    The IDTA and Addendum are in force, but there is a transition period until 21 September 2022 during which UK companies have the option to use either the IDTA or old EU SCCs in new contracts.

  • From 21 September 2022
    The old EU SCCs can no longer be used and UK companies must implement the IDTA/Addendum (as applicable) into all new contracts where personal data is being transferred to a third country.

  • By 21 March 2024
    All existing contracts entered into on or before 21 September 2022 which rely on the old EU SCCs as a valid transfer tool will need to be amended to incorporate the IDTA/Addendum (as applicable).

ICO guidance

The ICO have stated that they will soon be publishing the below additional tools to provide support and guidance to organisations using the IDTA/Addendum and carrying out TRAs:

  • Clause by clause guidance to the IDTA and Addendum
  • Guidance on how to use the IDTA
  • Guidance on transfer risk assessments
  • Further clarifications on international transfers guidance

Further reading

Fancy a natter about legal matters?

Are legal worries getting you down? Let the Law 365 team help you grow your business with less risk.

What makes us different?

  • We only work for Microsoft Partners, just like you.
  • We offer our services as a monthly subscription – so you can budget your legal costs for the year. No surprises.
  • We’re your  'in-house’ legal team, but we won’t bog you down in legal jargon.
  • We’ll work at your pace to get deals over the line. Fast.

Call us on 01892 313 943 or drop us a note at hello@law365.co


Law 365 – The Award-Winning Microsoft Partner Law Firm

Enjoyed this article?

Read some of our other Insights.

16 min read

1. Microsoft Partner Insights 2022 – Benchmarking Research

Welcome to the 2022 edition of Law 365’s Microsoft Partner Insights.  We teamed up with Incredible Results, analytics...
14 min read

2. Microsoft Partner Insights 2022 – Financial Review

What a year 2021 was! Just as 2020 brought a myriad of opportunities and threats, 2021 presented all Microsoft Partners...
9 min read

3. Microsoft Partner Insights 2022 – Recruitment

They say you can’t have a world-class business without world-class employees, and the competition in the marketplace...
Discover more insights