International Data Transfers under the UK GDPR

Based on the UK GDPR, broadly mirroring the EU GDPR, and the UK Data Protection Act 2018, an organization that transfers data out of the UK must have a valid data transfer mechanism in place.

In the EU, companies that transfer personal data to ‘non-adequate’ third countries outside the European Economic Area (EEA), tend to rely more and more on the EU Standard Contractual Clauses updated by the European Commission in 2021 to incorporate several considerations stemming from the CJEU Schrems II ruling. However, since this contractual tool was published after Brexit, it does not automatically apply to the UK. In the meantime, the Adequacy Decision adopted by the European Commission in 2021 allowed free flows of personal data between the European Union and the United Kingdom.

As a result, companies subject to the UK GDPR have faced legal ambiguities when undertaking the proper transfer mechanism for data flows outside of the national and European Union boundaries.

Following the first consultation in 2021, the Information Commissioner's Office intervened to clarify the issue and set forth a new data transfer framework under the UK data protection laws.

In February 2022, the Secretary of State laid before the British Parliament the new International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU Standard Contractual Clauses and a document setting out transitional provisions, which were finally approved and became effective on 21 March 2022.

the IDTA

On the one hand, the ICO introduces a new contractual instrument,, to fully replace the EU SCCs in transfers from the United Kingdom. The approach adopted is all-encompassing and does not differentiate by modules as provided by the European Commission. Furthermore, the IDTA does not integrate - as happens for the EU SCCs - all the requirements set out in art. 28 GDPR to regulate relationships and obligations regarding data protection between the contractual parties.

the Addendum

On the other hand,is introduced to simplify compliance for Organizations that have already adopted the EU SCCs. In this case, the EU SCCs are supplemented with the document issued by the ICO, integrating amendments and additions to the transfer tool of the European Commission.

transitional provisions

Furthermore, the ICO providedallowing the continued use of standard data protection clauses by data exporters, issued under the Data Protection Directive 95/46 / EC, as an appropriate safeguard under Article 46 (1) of the UK GDPR. In particular, the standard data protection clauses were issued under European Commission Decision 2001/497 / EC and European Commission Decision 2010/87 / EU.

In order to clarify interpretative and application uncertainties, it is expected that the ICO will intervene in the course of 2022 to issue additional guidelines, including detailed clause-by-clause guidance to the IDTA and UK Addendum and its implementation.

Furthermore, following the release in July 2023 of the EU-US Data Privacy Framework (DPF), the UK has established its extension to the DPF, also known as UK-US Data Bridge. The UK Secretary of State laid adequacy regulations, effective from October 12, 2023, ensuring secure data transfer to the US under Article 45 of the UK GDPR and endorsed by the US Attorney General's designation of the UK as a 'qualifying state' for a redress mechanism in case of unauthorized access by US authorities. This framework allows the free flow of personal data between the United Kingdom and US-based organizations participating in the self-certification scheme.

OneTrust, as part of its strong commitment toward data privacy and security, constantly works on ensuring the protection of its data flows on a global scale, in compliance with applicable legislation.

Starting on 21st March 2022, we endeavoured on defining the best approach to comply with the ICO’s International Data Transfers Addendum to our EU Standard Contractual Clauses, for our customers’ data transfers. For this purpose, by accessing this link https://www.onetrust.com/legal-sccs/, Customers subject to UK GDPR can access and download the applicable set, which incorporates the UK Addendum into their agreement with OneTrust or its Affiliate.

Furthermore, this commitment extends to all our Companies sharing personal data under the UK GDPR in the context of Intra-Group Transfers, as listed in further detail under the section 'Affiliates' at https://my.onetrust.com/s/article/List-of-Subprocessors.

Under these circumstances, OneTrust adopted the UK Addendum to the Intra-Group Agreement to safeguard and ensure the adequacy level of data protection within internal transfers across multiple third countries.

Additionally, for data flows towards the United States, as part of its commitment to safeguarding UK organisations' data, starting 12 October 2023, OneTrust self-certifies to and relies upon the UK-US Data Bridge under the Data Privacy Framework as a valid adequacy mechanism under Article 45 GDPR. When transferring data overseas, this ensures enhanced trust and safety for OneTrust and its UK customer base.

Finally, OneTrust regularly reviews and monitors its core service providers to ensure that they maintain appropriate technical and organisational measures, which effectively meet the UK GDPR requirements and protect the rights of data subjects. In addition, OneTrust works with its sub-processors to ensure that customers’ data onward transfers subject to the UK GDPR comply with the new UK Data Transfer Framework, as explained above.

More resources regarding data transfers and sub-processors are available below:

• OneTrust Schrems II Response Whitepaper

• Full list of OneTrust’s sub-processors

• UK-US data bridge: supporting documents

• UK-US data bridge: factsheet for UK organisations