Time is running out – deadline for the old EU standard contractual clauses draws near

On 21 March 2022 the International Data Transfer Agreement (“IDTA”) and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (the “Addendum”) came into force.

The Information Commissioner’s Office (“ICO”) announced that effective from 28 January 2022, the IDTA (commonly referred to as the ‘UK standard contractual clauses’) can be used in contractual documentation as an appropriate safeguard for transferring data outside of the UK and ensuring compliance with Article 46 of the UK GDPR.

Similarly, the Addendum can be used alongside the ‘new’ EU standard contractual clauses to achieve the same level of compliance.

To find out about the background of the ‘new’ and ‘old’ EU standard contractual clauses, click here.

The ‘old’ EU standard contractual clauses (which were replaced in June 2021) may still be used for those agreements entered into before 21 September 2022. Any agreements entered into prior to this date that use the old EU standard contractual clauses are deemed to have the appropriate safeguards up until 21 March 2024.

Organisations should take heed of these dates, as any contracts entered into after 21 September 2022 where data is being exported outside of the UK will need to incorporate either the IDTA or the Addendum in order to ensure compliance with the UK GDPR.

It is also worth considering those contracts that involve data exports that have been entered into prior to September 2022 and that expire after 21 March 2024. In these circumstances, contracting parties will inevitably require a ‘re-papering’ exercise to ensure the agreements remain compliant with data protection legislation.

In order to avoid hefty fines from the ICO, companies involved in the cross-border transfer of data should be pro-active and diarise these key dates and ensure that contracts remain up to date and compliant with the UK legislation.