We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKIDTA, Addendum, and TRA

UK GDPR IDTA, Addendum, and TRA

The and are alternative standard clauses for restricted transfers. Neither works by signature alone.

Complete the Article 46 data protection test, add any necessary protections, execute the clauses, and keep the conclusion under review.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
4 sections10 primary sources
Overview

Use the standalone International Data Transfer Agreement () or the International Data Transfer to the 2021 EU standard contractual clauses (Addendum) when a needs Article 46 standard clauses. Since 5 February 2026, the legislation calls the required assessment the data protection test; the ICO still calls it a transfer risk assessment (). You must decide, acting reasonably and proportionately, that protection after the transfer is not materially lower than in the UK.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

When should we use the IDTA or Addendum?

First confirm that your organisation initiates a and that current UK adequacy regulations do not cover it. Consider whether a specific Article 49 exception applies; for recurring or structured transfers, an Article 46 safeguard is normally the relevant route.

Choose either the or . The Addendum attaches UK requirements to the European Commission's 2021 EU SCCs and may suit organisations already using those clauses for EEA transfers. The EU SCCs alone do not support a UK . The IDTA is the standalone UK alternative.

  • Map each sender, recipient, role, location, onward transfer, data category, purpose, volume, frequency, and access method.
  • Select the correct instrument and complete its tables, modules, commercial references, security requirements, and optional clauses accurately.
  • Confirm the parties have legal authority to sign and that the instrument is legally binding before transfer.
  • Keep the transfer tool distinct from the Article 28 processor contract; one agreement may incorporate both sets of terms, but both duties must be met.
Question 2

How do we complete the transfer risk assessment?

Assess the protection people receive after transfer, taking account of all relevant circumstances and acting reasonably and proportionately. Examine the information and transfer, the selected safeguard, destination laws and practices that may affect it, the likelihood and consequences of access or non-compliance, enforceability and redress, and the effect of contractual, technical, and organisational measures.

If the test identifies a gap, add effective supplementary measures, such as strong encryption with keys inaccessible to the importer or changes that reduce the transferred data, where those measures address the actual risk. If protection remains materially lower for some or all data, do not rely on the safeguard for that portion; use a valid exception if available or stop the transfer.

  • Record the evidence, assumptions, legal and practical analysis, risk reasoning, supplementary measures, residual issues, approver, and date.
  • Test whether technical measures remain effective against the access powers or practices identified.
  • Cover remote access and cloud administration as well as file transmission.
  • Use one assessment for similar transfers only when the parties, data, purposes, laws, practices, measures, and risk remain materially the same.
Question 3

What evidence and review controls should we keep?

Keep the data-flow and role map, adequacy and exception checks, executed or and incorporated EU SCCs, completed , importer information, destination-law and practices evidence, supplementary measures, approvals, and notices. Record which transfers and onward transfers the pack covers.

A completed before 5 February 2026 does not need to be repeated merely because the legislation now calls it the data protection test. The ICO says a pre-commencement TRA that followed its guidance and concluded protection was sufficient meets the current test. Review it when the facts, law, measures, or risk change.

The ICO currently says to continue using A1.0 and B1.0 while it prepares updated instruments during 2026. The parties may choose the instruments' automatic-update mechanism. Also review on changes to the importer, sub-processors, destination, data, purpose, access pattern, security, government-access practices, legal challenge, or ICO guidance.

Recommended next step

Keep the clauses and assessment together

Tie each restricted transfer to its executed instrument, data protection test, supplementary measures, evidence owner, and review triggers.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Turn the restricted-transfer and data-protection tests into evidence requests and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to check a transfer route or safeguard against current ICO and legislative sources.

Explore next step
Talk to Sorena
Talk through implementation

Review the transfer map, clauses, TRA, supplementary measures, and next actions with Sorena.

Explore next step
Question 4

Questions and answers

Can we use the EU SCCs alone for a UK ?

No. The European Commission's 2021 SCCs do not by themselves provide UK Article 46 standard clauses. Use the UK with those SCCs, or use the standalone , then complete the and put any necessary supplementary measures in place.

Is a signed or enough?

No. Before relying on it, complete the , implement any extra technical, organisational, or contractual protections the assessment requires, and execute the safeguard so it binds the relevant parties. If the resulting protection is still materially lower, use a valid exception for that data or do not transfer it.

Primary sources

References and citations

ICO - Standard data protection clauses: the IDTA and Addendum
ico.org.uk2 citations
Referenced sections
  • Explains the available UK standard clauses, the difference between the IDTA and Addendum, and why EU SCCs alone are insufficient for UK restricted transfers.
  • Identifies the current instruments, their completion rules, the planned 2026 update, and the optional automatic-update mechanism.
Consolidated UK GDPR - Article 46
legislation.gov.uk
Referenced sections
  • Binding current source for Article 46 safeguards and the reasonable and proportionate data protection test.
ICO - International transfers
ico.org.uk
Referenced sections
  • Current ICO hub for restricted transfers, adequacy, safeguards, TRA guidance, exceptions, and transfer tools.
ICO - Rules on appropriate safeguards
ico.org.uk
Referenced sections
  • Explains when a safeguard becomes appropriate, the not-materially-lower test, supplementary protections, and when a transfer must not proceed.

Related guides

How do you choose a lawful basis under the UK GDPR?

Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.

UK Children's Code: Scope and 15 Standards

Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.

UK GDPR 72-Hour Breach Reporting: Decision Guide

Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.

UK GDPR Adequacy: When Can You Rely on It?

Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.

UK GDPR AI and Automated Decisions: Articles 22A-22D

Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.

UK GDPR Article 30 Records: What to Document

See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.

Show all related guides (40)

UK GDPR Controller or Processor: How to Decide

Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.

UK GDPR DPIA: When It Is Required and What to Record

Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.

UK GDPR DPO: When Appointment Is Mandatory

Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.

When do PECR cookie rules require consent?

Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.

UK GDPR 72-hour Breach Reporting Guide

Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.

UK GDPR Adequacy Guide

Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.

UK GDPR AI and Automated Decisions Guide

Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.

UK GDPR Applicability Test Guide

Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.

UK GDPR Article 30 Records Guide

Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.

UK GDPR Breach Notification Guide

Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.

UK GDPR Breach Workflow Guide

Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.

UK GDPR Children and Age Appropriate Design Guide

Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.

UK GDPR Children's Code Guide

A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.

UK GDPR Compliance Checklist

A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.

UK GDPR Compliance FAQ: Duties, Rights, and Decisions

Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.

UK GDPR Compliance Guide

Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.

UK GDPR Controller and Processor Status Guide

Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.

UK GDPR Data Subject Rights Guide

Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.

UK GDPR Deadlines and Compliance Calendar Guide

Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.

UK GDPR DPIA Workflow Guide

Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.

UK GDPR DPIAs and DPOs Guide

Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.

UK GDPR DSAR Workflow Guide

Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.

UK GDPR IDTA Addendum and Transfer Risk Assessment Guide

Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.

UK GDPR Lawful Bases Guide

Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.

UK GDPR PECR Cookies Guide

UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.

UK GDPR Penalties and Fines: Maximums and ICO Factors

Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.

UK GDPR Requirements Guide

Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.

UK GDPR Transfer Workflow Guide

Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.

UK GDPR Transfers, IDTA, and UK Addendum Guide

Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.

UK GDPR vs Data Protection Act 2018: How They Work Together

See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.

UK GDPR vs EU GDPR: Scope, Regulators and Transfers

Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.

UK IDTA vs EU SCCs: Which Transfer Contract to Use

Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.

UK vs EU GDPR Differences After the 2025 UK Reforms

Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.

UK vs EU GDPR Operations: Regulators, Breaches and Transfers

Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.