The Deadline for International Data Transfer agreements is here: have you updated your contracts and replaced old EU SCCs?

The Information Commissioner’s Office’s (ICO’s) 21^st March deadline for firms to update and amend International Data Transfer contracts is this week. Firms should verify that expired EU Standard Contractual Clauses (SCC) have been replaced in their contracts.  See the ICO’s Guide to International Transfers web page for more details

Prior to the deadline, UK firms transferring data to recipients outside of the UK (except in certain circumstances) who are located in a country the UK government has not approved as having “adequate safeguards” for the protection of the data, would rely on a transfer mechanism. The old EU SCCs were used widely as a data transfer mechanism and written into contracts between UK firms sending data to non-UK recipients.

As the old EU SCCs expire in a matter of days, firms must ensure that they have been replaced with either:

• the UK’s International Data Transfer Agreement (IDTA);

or

• the EU’s New Standard Contractual Clauses (New EU SCC’s) together with the UK’s International Data Transfer Addendum

to ensure that international transfers of data comply with data protection legislation.

If firms are not using the UK’s International Data Transfer Agreement, it is important to note that incorporating New EU SCCs into a contract alone is not sufficient; the UK Addendum must also be entered into by all parties relevant to the contract for the transfer of personal data to comply with UK GDPR.

The ICO’s deadline applies to all restricted transfers; any firm sharing personal data outside of the UK, regardless of controller or processer, must comply with the new requirements.

Firms who fail to update their contracts would be in breach of GDPR and the ICO have the power to issues fines of up to £17.5m (or, 4% of total annual worldwide turnover, whichever is higher).

For more information, see the ICO’s guidance, or get in touch with UKGI Compliance for additional advice and assistance at: info@ukgigroup.com.