The Information Commissioner's Office (ICO) has announced that the UK Department for Digital, Culture, Media and Sport (DCMS) laid before the UK Parliament on 2 February 2022:

• IDTA: a form of international data transfer agreement (IDTA);
• UK Addendum: a form of addendum to the European Commission’s standard contractual clauses (EU SCCs) approved in 2021 under EU GDPR; and 
• Transitional provisions: to the use of the current standard data protection clauses for international transfers from the UK (being standard contractual clauses previously approved by the European Commission under the pre-GDPR regime (old SCCs)).

The ICO has said these tools are "immediately of use", but they will only come into force on 21 March 2022, assuming Parliament does not object in the meantime (this is unlikely). This means that from 21 March, you are entitled to use these new tools to legitimise the transfer of personal data from the UK. The ICO previously consulted on drafts of the IDTA and UK Addendum from August to October 2021.

As a starting point, here is a quick reminder of the current rules. You can transfer personal data out of the UK:

• if the recipient country had been declared "adequate" for UK GDPR purposes (this includes the EEA and its approved list, and any other approved jurisdictions);
• if certain (limited) derogations or exceptions apply;
• under "binding corporate rules" signed up to by members of a group and approved by the relevant regulator; or
• by signing the old SCCs with the data importer. These old SCCs are being replaced by the new UK tools described above.

Why does this matter?

From 21 March 2022, you can transfer data out of the UK by signing either of the following with the data importer:

• the IDTA; or
• the EU SCCs together with the UK Addendum.

There is a grace period for legacy contracts/transfers (see below).

Also, one of the big changes to consider is that the old SCCs operated with only controller/controller and controller/processor models. The new EU SCCs and the UK's IDTA also offer alternatives for processor/processor and processor/controller models. This means greater symmetry and fewer manual workarounds as a result.

What should we do now?

If you rely on the old SCCs for transfers from the UK, you will need to adopt one of the new tools (unless you prefer another transfer solution described above – unlikely in practice).

The new UK tools go live on 21 March 2022, so you are formally permitted to use them from that date (assuming Parliament does not delay this or object in the meantime – unlikely). In any event, you will be obliged to start using the new UK tools for UK data transfers on contracts concluded on or after 22 September 2022.

What about the grace period?

There is a grace period for old SCCs concluded on or before 21 September 2022. These legacy contracts will continue to be valid for transfers out of the UK until 21 March 2024, provided that the relevant processing operations that are the subject of the contract remain unchanged and reliance on those SCCs ensures that the transfer of personal data is subject to appropriate safeguards.

This tracks the equivalent wording in the EU decision adopting the updated EU SCCs in 2021 and is probably a hint as to Schrems II (see below). Although you could hang on until the end of the UK grace period to uplift the legacy contracts, the earlier deadline for refreshing the EU SCCs (27 December 2022) may persuade organisations to refresh sooner. Certainly there are efficiencies in doing all this in one hit.

In any event, organisations should decide on their approach to refresh as soon as possible. If multiple customers and/or vendors, as data importers, are to be asked to sign the IDTA or EU SCCs plus the UK Addendum, that could be time-consuming and involved, so it is advisable to start that process sooner rather than later.

What is the choice as to tools?

Organisations with international/global operations, including across the UK and any EEA countries, are likely to prefer the EU SCCs plus UK Addendum over the IDTA. The Addendum approach involves less "new text" and so should benefit from simplicity and familiarity as organisations may well have already implemented the EU SCCs. The method for doing this will differ depending on whether EU SCCs have already been signed. Note that the UK Addendum is relatively light-touch and adds little to the EU SCCs apart from, of course, adapting the EU SCCs appropriately to refer to the UK, UK laws, England and Wales as the governing law, etc.

Whichever tool is selected, please bear in mind that the Schrems II court decision mentioned above affects the use of standard contractual clauses for transfers as this was issued before Brexit. Therefore, currently it is also law in the UK. This means that, as well as implementing one of the new tools for transfers out of the UK, organisations that export personal data from the UK will also (before commencing transfers) need to conduct and document what has become known as a "transfer impact assessment" or "data transfer impact assessment" in relation to the relevant destination country, importer and transfer concerned, and implement any supplementary measures that are necessary to protect the transferred personal data. The ICO had published a consultation draft international transfer risk assessment and tool in 2021, but the final version is not yet available.

Any other points to note?

Transfers from the UK to the EEA are, and will remain, lawful under the UK GDPR.

If any personal data has been transferred from the EEA to the UK, and then transferred from the UK to other countries, the transfer from the UK is an "onward transfer" for GDPR purposes. Under the UK GDPR, such a transfer can still be legally made under the new tools, from their effective date. However, a lot depends on the detail here and this needs careful consideration.

Please see the ICO's guidance page on these documents for links to the relevant documents. The ICO will be publishing the following guidance and clarifications soon, hopefully in good time before 21 March 2022:

• Clause by clause guidance to the IDTA and Addendum.
• Guidance on how to use the IDTA.
• Guidance on transfer risk assessments.
• Further clarifications on our international transfer guidance.

Next steps

• Assess the pros and cons and choose which of the new UK tools you prefer to adopt.
• Check required configuration of the new UK tools in the context of the EU SCCs and equivalent clauses for other exporting jurisdictions.
• Get ready to use the new UK tools from 22 September 2022. 
• Agree timing and strategy for contract refresh for legacy contracts