Implementing UK International Data Transfer Mechanisms

Overview

Following the UK's exit from the EU, the UK operates its own international data transfer regime under the UK GDPR (as retained and amended by the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019). The Information Commissioner's Office (ICO) has developed two instruments for international transfers: the International Data Transfer Agreement (IDTA), effective 21 March 2022, and the UK Addendum to the EU SCCs. The UK also maintains its own adequacy assessment framework independent of the European Commission's adequacy decisions.

UK Transfer Mechanisms

International Data Transfer Agreement (IDTA)

The IDTA is a standalone UK transfer mechanism that does not rely on the EU SCCs. It is laid before Parliament as a statutory instrument under Section 119A of the Data Protection Act 2018.

Structure:

• Part 1: Tables (completed by the parties to describe the transfer)
  • Table 1: Parties and Key Contacts
  • Table 2: Transfer Details (description, purpose, data categories, data subjects, frequency, retention)
  • Table 3: Technical and Organisational Security Measures (TFM Clauses)
  • Table 4: Extra Protection Clauses (supplementary measures addressing destination country risks)
• Part 2: Extra Protection Clauses (mandatory assessment of whether the destination country provides equivalent protection to UK GDPR)
• Part 3: Commercial Clauses (parties may add commercial terms in a linked agreement)
• Part 4: Mandatory Clauses (fixed text that cannot be amended)

Key features:

• Covers all four transfer relationship types (C2C, C2P, P2P, P2C) in a single document
• Requires a Transfer Risk Assessment (TRA) as part of Extra Protection Clauses
• Parties must review the IDTA when notified of a change affecting the transfer
• ICO retains the power to issue a revised IDTA at any time

UK Addendum to EU SCCs

The UK Addendum is an alternative to the IDTA that allows organisations already using EU SCCs (Commission Decision 2021/914) to extend those SCCs to cover UK GDPR-governed transfers by adding the Addendum.

Structure:

• Part 1: Tables
  • Table 1: Parties (references EU SCC Annex I.A)
  • Table 2: Selected SCCs, Modules, and Selected Clauses
  • Table 3: Appendix Information (references EU SCC Annexes I-III)
  • Table 4: Ending the Addendum When the Approved Addendum Changes
• Part 2: Mandatory Clauses of the Approved Addendum
• The Addendum incorporates the EU SCC text but replaces references to EU law with UK law references

When to use the Addendum vs. IDTA:

• Use the Addendum if EU SCCs are already executed and you want to extend coverage to UK transfers with minimal additional drafting
• Use the IDTA if the transfer is UK-only (no EU nexus) or if you prefer a standalone UK instrument
• Both instruments are equally valid under UK law

UK Adequacy Assessments

Countries with UK Adequacy Regulations

The UK Secretary of State has the power to make adequacy regulations under Section 17A of the Data Protection Act 2018. As of March 2026, the UK has adopted adequacy regulations for:

Country/Territory	Regulation	Effective Date
EU/EEA Member States	Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019	1 January 2021 (bridging mechanism)
Andorra	Adequacy Regulations 2023	12 October 2023
Argentina	Adequacy Regulations 2023	12 October 2023
Canada (PIPEDA organisations)	Adequacy Regulations 2023	12 October 2023
Faroe Islands	Adequacy Regulations 2023	12 October 2023
Guernsey	Adequacy Regulations 2023	12 October 2023
Israel	Adequacy Regulations 2023	12 October 2023
Isle of Man	Adequacy Regulations 2023	12 October 2023
Japan	Adequacy Regulations 2023	12 October 2023
Jersey	Adequacy Regulations 2023	12 October 2023
New Zealand	Adequacy Regulations 2023	12 October 2023
South Korea	Adequacy Regulations 2024	2024
Switzerland	Adequacy Regulations 2023	12 October 2023
Uruguay	Adequacy Regulations 2023	12 October 2023
United States (UK-US Data Bridge)	Adequacy Regulations 2023	12 October 2023

UK-US Data Bridge

The UK-US Data Bridge extends the DPF self-certification mechanism to UK-to-US transfers:

• US organisations self-certified to the DPF that also opt into the UK Extension are covered
• Verification: Check the DPF List at dataprivacyframework.gov and confirm the "UK Extension" is active
• Same principles and enforcement mechanisms as the EU-US DPF apply

ICO Transfer Risk Assessment (TRA)

The ICO has published a Transfer Risk Assessment tool to assist organisations in evaluating whether a transfer provides an essentially equivalent level of protection to that under UK law.

TRA Methodology

Step 1: Assess Whether a Restricted Transfer Is Taking Place

1. Confirm personal data is being transferred from the UK to a country outside the UK.
2. Confirm the destination country does not have UK adequacy regulations.
3. Confirm no exemption under Schedule 5 of the UK GDPR applies.

Step 2: Assess the Destination Country Legal Framework

Evaluate the destination country's laws and practices against four factors:

Factor	Assessment Questions
Respect for rule of law and human rights	Does the country have a functioning, independent judiciary? Is there an independent data protection authority?
Data protection legislation	Does the country have comprehensive data protection legislation? Does it provide individual rights equivalent to UK GDPR?
Government access to personal data	What laws authorise government access? Are there necessity and proportionality requirements? Is there independent oversight?
Enforcement and redress	Can individuals exercise rights against data controllers? Is there an effective complaint mechanism? Can individuals seek judicial redress?

Step 3: Assess the Transfer-Specific Risk

Factor	Assessment Questions
Sector and entity type	Is the importer in a sector with heightened government access risk (e.g., telecommunications)?
Data sensitivity	Does the transfer include special category data or data that creates higher risk if accessed?
Volume and frequency	Is this a one-time transfer or ongoing? What volume of data subjects is affected?
Importer track record	Has the importer previously received government access requests?
Technical protections	What technical measures are in place (encryption, pseudonymisation)?

Step 4: Determine Whether Additional Safeguards Are Needed

Based on the assessment, determine whether the IDTA or Addendum alone provides sufficient protection, or whether Extra Protection Clauses (supplementary measures) are needed.

Step 5: Document and Review

Document the TRA results and schedule periodic reviews (at least annually or upon trigger events).

IDTA Implementation at Athena Global Logistics

Table 1: Parties

Field	Exporter	Importer
Party name	Athena Logistics (UK) Ltd	TransPacific Freight Solutions Ltd
Contact person	David Morrison, UK Data Protection Manager	James Leung, Chief Privacy Officer
Address	30 Fenchurch Street, London EC3M 3BD, United Kingdom	88 Harbour Road, Wan Chai, Hong Kong SAR
Official registration	Companies House No. 12345678	Hong Kong Companies Registry CR-987654
Role	Exporter (Controller)	Importer (Processor)

Table 2: Transfer Details

Element	Detail
Description of transfer	Transfer of UK customer shipment data for Asia-Pacific freight consolidation and customs clearance
Purpose	Performance of freight forwarding services for UK-origin shipments to APAC destinations
Categories of data subjects	UK shipping customers (consignors), UK-based consignees, customs brokers
Categories of personal data	Full name, business email, phone, shipping address, customs IDs, consignment references
Special category data	None
Frequency	Continuous (real-time API); daily batch at 02:00 UTC
Retention	36 months from shipment completion

Table 3: Security Measures

Reference to the Annex II measures from the EU SCC implementation (TLS 1.3, AES-256 encryption at rest, RBAC with MFA, centralised SIEM, ISO 27001-certified facilities).

Table 4: Extra Protection Clauses

Extra Protection Clauses mirror the supplementary measures identified in TIA-2025-HK-001:

• End-to-end encryption for archived data with UK-held keys
• Contractual obligation to challenge disproportionate government requests
• 48-hour government access notification
• Annual audit rights
• Warrant canary
• Named-personnel access restriction

Dual EU-UK Transfer Management

For organisations like Athena Global Logistics that transfer data under both EU GDPR and UK GDPR, the recommended approach is:

1. EU transfers: Use EU SCCs (Commission Decision 2021/914) with EU TIA
2. UK transfers: Use UK Addendum to the EU SCCs (appended to the same SCC instrument)
3. Combined document: A single contractual package comprising the EU SCCs + UK Addendum covers both regimes
4. Separate TIAs: The EU TIA and UK TRA may reach different conclusions due to different legal standards; document both
5. Register: Maintain separate transfer register entries for EU-governed and UK-governed transfers to the same importer