Our guide to the latest European and UK data transfer rules
If you make a restricted transfer of personal data subject to the GDPR and/or UK GDPR, to a country without an adequacy decision, you need to comply with the Standard Contractual Clauses (SCCs). On 7 June 2021, the European Commission adopted the latest versions of the SCCs (the New SCCs) to govern such restricted transfers. The New SCCs were also adopted by the UK Government as well and the Information Commissioner’s Office (ICO) introduced the IDTA and UK addendum to the New SCCs as an appropriate safeguard for the purpose of making restricted transfers of personal data under the UK GDPR.
For transfers subject to the GDPR, any existing contracts using the old SCCs must now include the New SCCs. For transfers subject to the UK GDPR, no new contracts can be signed using the old SCCs. Any existing contracts using the old SCCs will not be considered as a valid transferring mechanism after 21 March 2024.
Why the change?
The rules were changed because the previous SCCs were outdated, didn’t cater for modern data transfers and didn’t include the mandatory processing wording required by the GDPR. Additionally, the UK has taken its own approach to data protection requirements since Brexit. The updated SCCs are in a modular format and whilst they provide more comprehensive protection for personal data transfers outside of the EU and UK, they are inevitably more complicated.
How we are helping
We have updated our SCCs Handbook to make compliance simpler. It covers key points such as how your business will be affected, what has changed with EU adequacy decisions, what is different in the updated SCCs, IDTA and the UK Addendum and how to apply them.
Extra support
Implementing the updated transferring mechanisms is likely to add to your data compliance workload, but our International Transfers Handbook is designed to ease that burden. Should you need extra support, we are ready to help; for example, we can set up an action plan to audit and review the contracts you’ll need to change.