International transfers of personal data post-Brexit

The law is changing on international transfers of personal data.

This month, the UK Information Commissioner’s Office launched an 8 week consultation on a new draft ‘International Data Transfer Agreement’ (IDTA) which will replace the Standard Contractual Clauses adopted by the European Commission. The IDTA can be used to send personal data to countries outside of the UK not covered by an ‘adequacy decision’.

Organisations must also complete a ‘Transfer Risk Assessment’ when sharing personal data internationally. This will require, amongst other assessments, an analysis of the laws of the recipient country to ensure an adequate level of protection for the personal data being transferred.

The consultation closes on 7 October 2021, after which we can expect to see some updated guidance, documents and rules for transferring personal data outside of the UK. This is likely to be an onerous task for organisations facilitating cross-border transfers, even for ‘low risk’ processing.

Please contact our data protection specialists below if you need any advice or tools on international transfers of personal data, impact assessments or data protection and privacy more widely.