Use the standalone IDTA for a UK-only transfer contract, or attach the UK Addendum to the European Commission's 2021 SCCs when that contract structure fits the deal.
The contract is only one part of the decision. Confirm that the transfer is restricted, check for UK approval regulations or an exception, and apply the Article 46 data protection test through a documented transfer risk assessment.
Structured answer sets in this page tree.
Cited legal and guidance references.
For a under the UK GDPR, the exporter may choose either the standalone International Data Transfer Agreement (IDTA) or the UK Addendum attached to the approved 2021 EU Standard Contractual Clauses (EU SCCs). EU SCCs alone are not a UK safeguard. The Addendum is often easier when the parties already use EU SCCs, but it is also available for UK-only transfers. In either case, the parties must complete the contract correctly and the UK exporter must complete a transfer risk assessment to apply the and show that protection after transfer is not materially lower.
Compare the two UK contractual routes by purpose, parties, structure, assessment, evidence, and use alongside EU GDPR.
A standalone UK contract for restricted transfers using standard data protection clauses.
The Commission's approved 2021 EU SCCs modified by the UK Addendum for UK restricted transfers.
| Dimension | IDTA | EU SCCs + UK Addendum | Operational implication |
|---|---|---|---|
| What it does | The IDTA supplies the complete approved UK contractual safeguard in one instrument. | The Addendum modifies approved 2021 EU SCCs so they can supply the UK contractual safeguard. EU SCCs without the Addendum do not do this. | Choose a UK route only after confirming that the transfer is restricted and is not already covered by approval regulations. |
| Contract structure | Complete the IDTA Part 1 tables and include Part 4 mandatory clauses. Parts 2 and 3 are optional areas for extra protection and commercial clauses. | Complete the Addendum tables, identify the approved EU SCCs and module, and complete the incorporated SCC annexes and selections. | The shorter Addendum is not a standalone form; its operation depends on the identified EU SCC contract. |
| When it usually fits | The IDTA can fit a UK-focused contract where the parties do not need an EU SCC package. | The Addendum can reduce duplication when the parties already use EU SCCs for EEA transfers. It may also be used when only UK GDPR applies. | Contract convenience does not change the transfer test or remove the assessment. |
| Transfer assessment | The UK exporter must assess the transfer and identify any extra protections needed to meet the Article 46 . | The same UK assessment is required when the Addendum is used. If EU GDPR also applies, the EU SCC assessment remains a separate conclusion under EU law. | Do not label one undifferentiated document as both the UK and EU assessment without showing how each legal test is met. |
| Parties and responsibility | The sender and receiver must ensure that the IDTA details are correct and comply with its obligations. | The parties must correctly identify the Addendum parties, EU SCC roles and module, and the UK-specific selections. | Match legal entities and transfer roles to the actual data flow; a group name or vendor brand is not enough. |
| Evidence to retain | Keep the signed IDTA, completed tables, transfer map, assessment, extra protections, approvals, and review triggers. | Keep the signed EU SCCs and Addendum, completed annexes and selections, UK assessment, any EU assessment, supplementary measures, approvals, and review triggers. | Review the package when the data flow, destination, parties, law, onward transfers, or ability to comply changes. |
The IDTA supplies the complete approved UK contractual safeguard in one instrument.
The Addendum modifies approved 2021 EU SCCs so they can supply the UK contractual safeguard. EU SCCs without the Addendum do not do this.
Choose a UK route only after confirming that the transfer is restricted and is not already covered by approval regulations.
Complete the IDTA Part 1 tables and include Part 4 mandatory clauses. Parts 2 and 3 are optional areas for extra protection and commercial clauses.
Complete the Addendum tables, identify the approved EU SCCs and module, and complete the incorporated SCC annexes and selections.
The shorter Addendum is not a standalone form; its operation depends on the identified EU SCC contract.
The IDTA can fit a UK-focused contract where the parties do not need an EU SCC package.
The Addendum can reduce duplication when the parties already use EU SCCs for EEA transfers. It may also be used when only UK GDPR applies.
Contract convenience does not change the transfer test or remove the assessment.
The UK exporter must assess the transfer and identify any extra protections needed to meet the Article 46 .
The same UK assessment is required when the Addendum is used. If EU GDPR also applies, the EU SCC assessment remains a separate conclusion under EU law.
Do not label one undifferentiated document as both the UK and EU assessment without showing how each legal test is met.
The sender and receiver must ensure that the IDTA details are correct and comply with its obligations.
The parties must correctly identify the Addendum parties, EU SCC roles and module, and the UK-specific selections.
Match legal entities and transfer roles to the actual data flow; a group name or vendor brand is not enough.
Keep the signed IDTA, completed tables, transfer map, assessment, extra protections, approvals, and review triggers.
Keep the signed EU SCCs and Addendum, completed annexes and selections, UK assessment, any EU assessment, supplementary measures, approvals, and review triggers.
Review the package when the data flow, destination, parties, law, onward transfers, or ability to comply changes.
Start with the ICO's three-step restricted-transfer test: the UK GDPR must apply to the sender's processing, the sender must initiate and agree to send or make personal information accessible to a separate organisation, and the receiver must be located outside the UK or covered by an applicable exception to the location rule. Remote access can be a transfer; sending data within the same legal entity is not a .
If the transfer is restricted, first check whether UK approval regulations cover the destination and transfer type. If they do not, consider an Article 46 safeguard such as the IDTA or Addendum. Article 49 exceptions are limited routes for specific situations, not a routine substitute for a safeguard.
The IDTA has four parts. Part 1 identifies the parties, transfer details, personal information, and security requirements; Part 4 contains the mandatory clauses. Parts 2 and 3 can add extra protection and commercial terms. The Addendum identifies the parties and the approved EU SCCs, modules, selections, and appendix information that it modifies for UK law.
Both parties must ensure that the contract details are accurate and comply with the contractual obligations. The exporter should also retain the transfer facts, destination analysis, assessment conclusion, any supplementary technical or organisational measures, approvals, and review triggers. Reassess when the parties, purposes, data, destination law, government-access risk, onward transfers, or safeguards materially change.
Record the transfer map, selected instrument, required contract fields, assessment evidence, supplementary measures, owners, and review triggers.
Turn the transfer decision into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.