The UK's International Data Transfer Agreement: what it is and what it means for you
On 21 March 2022, the UK's International Data Transfer Agreement came into force, along with an Addendum.
I've written about the International Data Transfer Agreement before and, bluntly, I wasn't particularly flattering about them:
The UK's International Data Transfer Agreement: is this the ICO's worst document yet?
Unfortunately but unsurprisingly, the version of the Agreement which has come into force is the version I reviewed in February, and so exhibits a number of significant (in my view, at least) problems.
What is the International Data Transfer Agreement for?
If you are transferring personal data from the UK to a country which is not "adequate" for data protection purposes, you need to find a legal mechanism to make that transfer.
One of those mechanisms is by providing "appropriate safeguards", and a method for providing those appropriate safeguards is to use standard data protection clauses issued by the ICO under s119A Data Protection Act 2018.
The Agreement / Addendum are an instance of these standard data protection clauses.
Organisations are now able to use the Agreement, or the separate Addendum, as a transfer tool to comply with Article 46 of the UK GDPR when making restricted transfers.
Can you continue to use the old / Transitional Standard Clauses?
According to the ICO's transitional guidance:
Contracts concluded on or before 21 September 2022 on the basis of any Transitional Standard Clauses shall continue to provide appropriate safeguards for the purpose of Art 46(1) of the UK GDPR until 21 March 2024, provided that the processing operations that are the subject matter of the contract remain unchanged and reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards.
So, yes, you can continue to sign the Transitional Standard Clauses.
Should you? That's a different question, and will depend on your particular circumstances and needs.
No guidance... yet
Apparently, the ICO is going to publish some guidance on the Agreement and Addendum but it is seemingly not yet available.
With a bit of luck, given how the Agreement's problems, the ICO is taking its time over the guidance, to try to iron out some of the kinks.