We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKIDTA, Addendum, and TRA

UK GDPR IDTA, Addendum, and TRA

The IDTA and Addendum are alternative standard clauses for restricted transfers. Neither works by signature alone.

Complete the Article 46 data protection test, add any necessary protections, execute the clauses, and keep the conclusion under review.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
10

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

Use the standalone International Data Transfer Agreement () or the International Data Transfer to the 2021 EU standard contractual clauses (Addendum) when a needs Article 46 standard clauses. Since 5 February 2026, the legislation calls the required assessment the data protection test; the ICO still calls it a transfer risk assessment (). You must decide, acting reasonably and proportionately, that protection after the transfer is not materially lower than in the UK.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

When should we use the IDTA or Addendum?

First confirm that your organisation initiates a and that current UK adequacy regulations do not cover it. Consider whether a specific Article 49 exception applies; for recurring or structured transfers, an Article 46 safeguard is normally the relevant route.

Choose either the or . The Addendum attaches UK requirements to the European Commission's 2021 EU SCCs and may suit organisations already using those clauses for EEA transfers. The EU SCCs alone do not support a UK . The IDTA is the standalone UK alternative.

  • Map each sender, recipient, role, location, onward transfer, data category, purpose, volume, frequency, and access method.
  • Select the correct instrument and complete its tables, modules, commercial references, security requirements, and optional clauses accurately.
  • Confirm the parties have legal authority to sign and that the instrument is legally binding before transfer.
  • Keep the transfer tool distinct from the Article 28 processor contract; one agreement may incorporate both sets of terms, but both duties must be met.
Citations
Question 2

How do we complete the transfer risk assessment?

Assess the protection people receive after transfer, taking account of all relevant circumstances and acting reasonably and proportionately. Examine the information and transfer, the selected safeguard, destination laws and practices that may affect it, the likelihood and consequences of access or non-compliance, enforceability and redress, and the effect of contractual, technical, and organisational measures.

If the test identifies a gap, add effective supplementary measures, such as strong encryption with keys inaccessible to the importer or changes that reduce the transferred data, where those measures address the actual risk. If protection remains materially lower for some or all data, do not rely on the safeguard for that portion; use a valid exception if available or stop the transfer.

  • Record the evidence, assumptions, legal and practical analysis, risk reasoning, supplementary measures, residual issues, approver, and date.
  • Test whether technical measures remain effective against the access powers or practices identified.
  • Cover remote access and cloud administration as well as file transmission.
  • Use one assessment for similar transfers only when the parties, data, purposes, laws, practices, measures, and risk remain materially the same.
Citations
Question 3

What evidence and review controls should we keep?

Keep the data-flow and role map, adequacy and exception checks, executed or and incorporated EU SCCs, completed , importer information, destination-law and practices evidence, supplementary measures, approvals, and notices. Record which transfers and onward transfers the pack covers.

A completed before 5 February 2026 does not need to be repeated merely because the legislation now calls it the data protection test. The ICO says a pre-commencement TRA that followed its guidance and concluded protection was sufficient meets the current test. Review it when the facts, law, measures, or risk change.

The ICO currently says to continue using A1.0 and B1.0 while it prepares updated instruments during 2026. The parties may choose the instruments' automatic-update mechanism. Also review on changes to the importer, sub-processors, destination, data, purpose, access pattern, security, government-access practices, legal challenge, or ICO guidance.

Citations
Recommended next step

Keep the clauses and assessment together

Tie each restricted transfer to its executed instrument, data protection test, supplementary measures, evidence owner, and review triggers.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Turn the restricted-transfer and data-protection tests into evidence requests and review tasks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to check a transfer route or safeguard against current ICO and legislative sources.

Explore next step
Talk to Sorena
Talk through implementation

Review the transfer map, clauses, TRA, supplementary measures, and next actions with Sorena.

Explore next step
Primary sources

References and citations

Consolidated UK GDPR - Article 46
legislation.gov.uk
Referenced sections
  • Binding current source for Article 46 safeguards and the reasonable and proportionate data protection test.
ICO - International transfers
ico.org.uk
Referenced sections
  • Current ICO hub for restricted transfers, adequacy, safeguards, TRA guidance, exceptions, and transfer tools.
ICO - Rules on appropriate safeguards
ico.org.uk
Referenced sections
  • Explains when a safeguard becomes appropriate, the not-materially-lower test, supplementary protections, and when a transfer must not proceed.
Related guides

Explore more topics

How do you choose a lawful basis under the UK GDPR?
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
UK Children's Code: Scope and 15 Standards
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
UK GDPR 72-hour Breach Reporting Guide
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
UK GDPR 72-Hour Breach Reporting: Decision Guide
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
UK GDPR Adequacy Guide
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
UK GDPR Adequacy: When Can You Rely on It?
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
UK GDPR AI and Automated Decisions Guide
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
UK GDPR AI and Automated Decisions: Articles 22A-22D
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
UK GDPR Applicability Test Guide
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
UK GDPR Article 30 Records Guide
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
UK GDPR Article 30 Records: What to Document
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
UK GDPR Breach Notification Guide
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
UK GDPR Breach Workflow Guide
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
UK GDPR Children and Age Appropriate Design Guide
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
UK GDPR Children's Code Guide
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
UK GDPR Compliance Checklist
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
UK GDPR Compliance FAQ: Duties, Rights, and Decisions
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
UK GDPR Compliance Guide
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
UK GDPR Controller and Processor Status Guide
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
UK GDPR Controller or Processor: How to Decide
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
UK GDPR Data Subject Rights Guide
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
UK GDPR Deadlines and Compliance Calendar Guide
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
UK GDPR DPIA Workflow Guide
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
UK GDPR DPIA: When It Is Required and What to Record
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
UK GDPR DPIAs and DPOs Guide
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
UK GDPR DPO: When Appointment Is Mandatory
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
UK GDPR DSAR Workflow Guide
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
UK GDPR IDTA Addendum and Transfer Risk Assessment Guide
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
UK GDPR Lawful Bases Guide
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR PECR Cookies Guide
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
UK GDPR Penalties and Fines: Maximums and ICO Factors
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
UK GDPR Requirements Guide
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
UK GDPR Transfer Workflow Guide
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
UK GDPR Transfers, IDTA, and UK Addendum Guide
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
UK GDPR vs Data Protection Act 2018: How They Work Together
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
UK GDPR vs EU GDPR: Scope, Regulators and Transfers
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
UK IDTA vs EU SCCs: Which Transfer Contract to Use
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
UK vs EU GDPR Differences After the 2025 UK Reforms
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
UK vs EU GDPR Operations: Regulators, Breaches and Transfers
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
When do PECR cookie rules require consent?
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.