How to Use the International Data Transfer Agreement for Compliance

If your business transfers personal data outside the UK, you must ensure compliance with stringent data protection rules. The Information Commissioner’s Office (ICO) has issued the International Data Transfer Agreement (IDTA) as a recognised transfer tool for legally safeguarding international transfers of personal data. The IDTA provides a legally recognised framework to help businesses meet their obligations when transferring personal data to countries without UK adequacy decisions. However, before using the IDTA or any other transfer mechanism, you must assess how personal data moves within your business and where it is sent. This article explores key international data transfer issues to consider and how to use the IDTA for compliance. 

Why Should You Know Your Data Flows?

Understanding your data flows is essential for compliance. Without a clear picture of where personal data is going, you could miss important international transfers and rules requiring extra compliance steps for your business. 

You should map how data moves within your business, identifying when it leaves the UK, who receives it, and why. This will help you determine whether an adequacy decision applies or if you need a safeguard under the UK GDPR.

For certain businesses, such as UK businesses with no EU operations, the IDTA may be the appropriate document for international data transfers.

If you choose the IDTA, you must conduct a Transfer Risk Assessment (TRA). This assessment determines whether additional safeguards are required to ensure UK GDPR compliance.

What is the Purpose of the IDTA?

The IDTA allows you to send personal data to countries that do not have a UK adequacy decision.

It is an alternative to the EU SCCs and uses a single agreement rather than a modular format. It can also be linked to a broader contract, such as a data processing agreement.

How is the IDTA Structured?

The IDTA sets out key legal requirements for compliant international data transfers. For example, the parties must secure the data, handle data subject requests, and cooperate with regulators. Individuals retain UK GDPR rights, including access, correction, and deletion, even when data is sent to a country without an adequacy decision. The IDTA also defines breach response obligations and liability allocation.

The IDTA follows a structured approach which is designed to be user-friendly. To use it: 

• you must record key details in the document, including the parties involved, the categories of personal data, and the purpose of the transfer; 
• if your TRA identifies risks, you include extra protection clauses. These safeguards may involve technical, organisational, or contractual measures;
• you may add optional commercial clauses as long as they do not reduce data protection standards; and
• the document contains critical, mandatory legal clauses set out key legal responsibilities, enforcement provisions, and liability rules. You must keep these legal provisions unchanged. Removing or altering them could invalidate the IDTA as a lawful safeguard under the UK GDPR.

How Should Your Business Use the IDTA?

To implement the IDTA, you must carefully review, understand, and complete it correctly.

To meet UK GDPR requirements, you must accurately complete contract details, conduct a Transfer Risk Assessment, and apply any necessary security measures. Remember that you cannot change the mandatory clauses; any additional commercial terms must not undermine data protection safeguards.

Once you finalise all details, you must sign the agreement for it to become legally binding.  You should also conduct regular reviews to maintain compliance with legal and operational changes.

GDPR Essentials Factsheet

This factsheet sets out how your business can become GDPR compliant.

Download Now

If you fail to complete the IDTA correctly, you risk non-compliance with UK GDPR, which could lead to regulatory penalties. 

You must take the time to understand the IDTA, determine whether it is the proper transfer mechanism for your business, and ensure compliance. Instead of signing the document without understanding its implications, you should make sure you fully assess your obligations and can comply with them. A data protection lawyer can advise you if you need tailored guidance on what the IDTA means in practice. 

Key Takeaways

The IDTA provides a UK-specific solution for international data transfers. Unlike the EU SCCs, which follow a modular structure, the IDTA applies a single-agreement approach tailored to UK GDPR requirements. It offers a legally recognised transfer framework where no UK adequacy decision applies. However, the IDTA is by no means a ‘quick fix’. It imposes strict legal responsibilities on parties, including compliance with provisions for security, liability, and data subject rights. You must ensure you can meet these obligations before signing the agreement and check that the data importer you send personal data to can do so too. 

If you need help drafting an international data transfer agreement, our experienced data, privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to solicitors to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.

Frequently Asked Questions