Personal data export from the UK

This article was published in March 2022 and reflects the regulatory position at that time. For current guidance on this topic, contact Bratby Law or see our latest insights.

Quick answer. In February 2022 the UK published two alternative sets of contracts for exporting personal data from the UK to non-adequate countries: the International Data Transfer Agreement (IDTA), a standalone UK-drafted agreement, and the International Data Transfer Addendum to the EU SCCs, for organisations already using the EU forms. Both respond to the ECJ’s Schrems II decision and require a transfer impact assessment.

UK sets out two alternatives to provide adequate contractual protection for the export of personal data from the UK

What happened?

In February 2022, the UK government published 2 alternative sets of contracts that can be used by organisations wishing to export personal data from the UK to countries that do not otherwise provide adequate protection, both of which take account of the ECJ’s decision in Schrems II. The contracts are not needed if the destination country’s laws provide adequate data protection – so are not needed for data export to the EU (or EEA, or other countries with adequate statutory protection). The two alternatives are:

1. an addendum to the SCCs recently published by the European Commission (“SCC Addendum“), which in large part adopts the new EU SCCs
2. a UK only International Data Transfer Agreement (“IDTA“)

Background – UK GDPR requires adequate protection for personal data export

Following Brexit, UK data protection law (specifically UK GDPR) continues (for now) to largely mirror EU data protection law. Articles 44-50 of the UK GDPR prohibit the export of personal data from the UK to a third country unless the data exporter can ensure that ‘the level of protection of natural persons‘ is the same after export as within the UK.

UK GDPR sets out alternative ways in which the legally required protection for exported personal data can be achieved:

• first, the UK may find that the third country’s laws provide adequate protection (article 45 GDPR) and personal data may be exported on that basis.
• second, personal data may be exported where appropriate safeguards are put in place with enforceable data subject rights and effective legal remedies for data subjects are available (article 46(1) GDPR). GDPR specifies what appropriate safeguards may be used:
  • a legally binding and enforceable instrument between public authorities or bodies (art 46(2)(a))
  • binding corporate rules (art 46(2)(b))
  • use of standard data protection clauses adopted by the UK Government or ICO (art 46(2)(c)and (d))
  • an approved code of conduct together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights (art 46(2)(e))
  • an approved certification mechanism together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights (art 46(2)(f))
  • subject to approval byICO, contractual clauses and/or cross border administrative arrangements (art 46(3)
• Finally, there are limited derogations (art 49) which allow the export of personal data in the certain ‘exceptional’ circumstances. The derogations should not be relied on for routine ‘business as usual’ data export.

Timing and transitional provisions

Unlike the EU, the old EU SCCs remain valid for data export from the UK until 21 March 2024 provided that they were entered into before 21 September 2022.

While the new arrangements only become mandatory from 22 September 2022, we recommend that they are used for all new data export contracts and that a process is started to review and replace existing arrangements before March 2024.

UK SCC Addendum

It is very welcome that the Addendum effectively adopts the EU SCCs, and allows companies that are using the SCCs for their EU (and EEA) data export to effectively adopt the same approach for the UK.

In practice, multi-national organisations are using the Addendum in preference to negotiating UK specific data export arrangements.

UK IDTA

The UK IDTA is a solution is search of a problem, and while it offers an interesting alternative to the SCCs its use in the real world seems likely to be very limited.

Update: data export under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 changed the UK framework for data export from 5 February 2026. It replaced Articles 44 and 45 of the UK GDPR: under new Articles 44A, 45A and 45B, the Secretary of State may approve transfers to a country by regulations where the data protection test is met, that is, where the standard of protection there is not materially lower than in the UK. Adequacy regulations in force before that date are treated as if made under Article 45A, so countries already recognised as adequate keep that status.

For transfers made on appropriate safeguards, Article 46(1A) now requires the exporter, acting reasonably and proportionately, to consider that a corresponding data protection test is met, and Article 47A allows the Secretary of State to specify further standard data protection clauses by regulations. Existing IDTA and SCC Addendum arrangements remain valid safeguards under Article 46(2)(d) and do not need to be replaced.

Practical steps for data export compliance

Organisations that export personal data from the UK should maintain a register of international transfers, documenting the transfer mechanism used, the destination country and the transfer risk assessment for each data export. Where a transfer risk assessment identifies concerns about the destination country’s legal framework, supplementary measures may be needed alongside the IDTA or SCC Addendum. The ICO has published guidance on international transfers including a transfer risk assessment tool.

For advice on data export mechanisms, transfer risk assessments and international data transfers, see our page on data governance, transfers and accountability or contact Rob Bratby.

Subscribe below for updates on data protection, or contact Rob Bratby at Bratby Law.