September deadline approaches to use UK’s new data transfer agreements

Businesses that transfer personal data from the UK to other countries have until 21 September 2022 to conclude negotiations on outstanding contracts if they wish to rely on the old EU Standard Contractual Clauses (old EU SCCs) as a safeguarding mechanism. All contracts finalised after this date must incorporate either the new International Data Transfer Agreement (IDTA) or the new EU SCCS with the UK Addendum (both of which came into force on 21 March 2022, see our original post on the announcement). 

Our senior data protection solicitor, Becky White explains:

We’re now approaching the end of a 6-month grace period since the announcement of these new  provisions. While the change may seem like a burden to some businesses, the new provisions actually provide better flexibility and will help streamline contract negotiation and drafting.

‘Agreements using the old EU SCCs that are concluded before 21 September 2022, will continue to be valid until 21 March 2024.  However, for agreements concluded after 21 September 2022, organisations will need to use either the IDTA or the UK Addendum as a transfer mechanism to comply with the requirement under Art. 46 of the UK GDPR to provide “appropriate safeguards” for personal data when it is transferred from the UK to countries which are not covered by the UK’s adequacy regulations. 

This deadline is also a timely reminder for businesses to think holistically about contractual remediation. The deadline to repaper all existing agreements relying on the old EU SCCs is only 4 months away.  So getting ahead of this deadline and ensuring there is no last minute panic, will ease the negotiation process generally and reassure your suppliers and customers that you are committed to data protection compliance.  It is important businesses seek advice now if these contracts need to be re-negotiated as well as redrafted.’

 Key dates to note

• 21 September 2022: New contracts not concluded before this date that are subject to UK GDPR must use the IDTA or UK Addendum from this point on.
• 27 December 2022: Organisations need to have transitioned all existing contracts subject to EU GDPR using the old SCCs to the new EU SCCs by this date.
• 21 March 2024: Organisations need to have transitioned all existing contracts subject to UK GDPR (i.e. concluded before 21 Sept 2022) using the old SCCs to the new IDTA or UK Addendum by this date.

Practical next steps

If your business is affected by these by these changes, you’ll need to undertake a contract remediation project, migrating your agreements to the new transfer provisions. Becky and our team of professional data protection and commercial solicitors can help you throughout this process by:

• Identifying and updating affected existing contracts
• Mapping your data flows
• Completing any necessary transfer risk assessments
• Drafting any new transfer agreements and/or data processing agreements to use the appropriate new UK data transfer agreements or EU SCCs