A MoFo Privacy Minute Q&A: The UK’s Deadline to Conclude New Standard Contractual Clauses for Existing Contracts Approaches

This is A MoFo Privacy Minute, where we will answer the questions our clients are asking us in sixty seconds or less.

Question: My business still relies on the old EU Standard Contractual Clauses under Directive 95/46/EC (“old EU SCCs”) as a data transfer mechanism when transferring personal data subject to the UK GDPR outside the UK (a “restricted transfer”).

By when does my business need to replace the old EU SCCs? 

Answer: As of March 21, 2024, businesses subject to the UK GDPR (“UK businesses”) that carry out restricted transfers to countries without a UK adequacy decision can no longer use the old EU SCCs as a data transfer mechanism. Instead, they will have to rely on the UK International Data Transfer Agreement (IDTA) or the new EU Standard Contractual Clauses with the UK Addendum (“UK SCCs Addendum”), unless the business has obtained a UK Binding Corporate Rules authorisation or can rely on an exemption for the restricted transfer. This means UK businesses that routinely carry out restricted transfers subject to the UK GDPR should review their data transfer mechanisms in case they are required to implement either the IDTA or UK SCCs Addendum.

Under the EU GDPR, businesses are required to use the new EU Standard Contractual Clauses (“new EU SCCs”) or another valid data transfer mechanism. However, when the UK government adopted the IDTA and UK SCCs Addendum in February 2022, it provided a transitional period whereby UK businesses were required to switch to the IDTA or UK SCCs Addendum by September 21, 2022 for new contracts but had until March 21, 2024 to update their existing contracts.

As a reminder, the UK SCCs Addendum incorporates and adapts the new EU SCCs so they work under UK law. In contrast, the IDTA is structured slightly differently but covers issues not addressed by the new EU SCCs or the UK SCCs Addendum (such as the ability to rely on the IDTA as a transfer mechanism when the data importer is outside the UK but subject to the UK GDPR). Over the past two years, many UK businesses have chosen to use the UK SCCs Addendum rather than the IDTA for their restricted transfers, given their existing familiarity with the new EU SCCs, and for simplicity when the UK business is facilitating data transfers subject to both the EU GDPR and UK GDPR. We note, however, there are some benefits to relying on the IDTA when the restricted transfer is only subject to the UK GDPR but not the EU GDPR.

In addition, and as discussed in more detail in our client alert, UK businesses will also need to conclude a transfer risk assessment (TRA) when carrying out a restricted transfer. Recently, the UK Information Commissioner’s Office (ICO) confirmed that UK businesses making restricted transfers to businesses in the United States (see our article) can simplify and replace their TRA with template language proposed by the ICO.

Michal Pati, London trainee solicitor, contributed to the drafting of this alert.