Personal data transfer deadline looming
The imminent deadline for businesses transferring personal data outside the UK is fast approaching, warns national leading law firm Clarke Willmott LLP.
Changes to UK data protection laws mean firms using EU standard contractual clauses (SCCs) must update the documentation to the new UK-mandated contractual clauses by 21st March.
Rebecca Hallam and Sana Shah, from Clarke Willmott’s commercial team, say that because of Brexit, SSCs alone are insufficient to safeguard the transfer of personal data to third countries.
“Transfer of personal data faces no restrictions when sent to countries outside the UK that have been officially recognised as ‘adequate’ by the UK government,” says Rebecca Hallam, who is an associate.
“The largest block of countries deemed to be adequate is the European Economic Area (EEA), which includes EU countries and Iceland, Liechtenstein- and Norway.
“Any countries not deemed adequate are referred to as ‘third countries’ and data protection legislation requires that other ‘appropriate safeguards’ are put in place.”
In March 2022, the Information Commissioner’s Office published the UK International Data Transfer Agreement (IDTA) and the IDTA Addendum, intended to replace SCCs.
“For any new contracts entered into since September 2022, the SCCs have been deemed an invalid mechanism for the transfer; instead, parties have had to use the IDTA or IDTA Addendum.
“Contracts entered into before September 2022 have been given a longer grace period in which to make the switch to the IDTA or IDTA Addendum.
“For these, existing SCCs have continued to remain a suitable method for international data transfers. However, by 21st March all existing contracts must have been updated.”
Solicitor Sana Shah says it is advisable to assess international data transfers as the deadline draws near.
“This means examining any existing agreements that incorporate the old EU SCCs and initiating the process of updating them to the new UK SCCs well in advance of the statutory deadline.
“If contracts still rely on SCCs, these should be amended to reflect the IDTA or IDTA Addendum as appropriate before 21st March.”
Clarke Willmott is a national law firm with offices in Birmingham, Bristol, Cardiff, London, Manchester, Southampton, and Taunton and is celebrating its 135th anniversary this year.
For further information please contact Rebecca Hallam rebecca.hallam@clarkewillmott.com or Sana Shah sana.shah@clarkewillmott.com
