Use the standalone IDTA for a UK-only transfer contract, or attach the UK Addendum to the European Commission's 2021 SCCs when that contract structure fits the deal.
The contract is only one part of the decision. Confirm that the transfer is restricted, check for UK approval regulations or an exception, and apply the Article 46 through a documented transfer risk assessment.
For a under the UK GDPR, the exporter may choose either the standalone International Data Transfer Agreement (IDTA) or the UK Addendum attached to the approved 2021 EU Standard Contractual Clauses (EU SCCs). EU SCCs alone are not a UK safeguard. The Addendum is often easier when the parties already use EU SCCs, but it is also available for UK-only transfers. In either case, the parties must complete the contract correctly and the UK exporter must complete a transfer risk assessment to apply the and show that protection after transfer is not materially lower.
Side-by-side comparison
IDTA vs EU SCCs with the UK Addendum
Compare the two UK contractual routes by purpose, parties, structure, assessment, evidence, and use alongside EU GDPR.
Sets the current reasonable and proportionate UK data protection test.
The same UK assessment is required when the Addendum is used. If EU GDPR also applies, the EU SCC assessment remains a separate conclusion under EU law.
Specifies the transfer details and review information captured by the IDTA.
Keep the signed EU SCCs and Addendum, completed annexes and selections, UK assessment, any EU assessment, supplementary measures, approvals, and review triggers.
Sets the current reasonable and proportionate UK data protection test.
EU SCCs + UK Addendum
The same UK assessment is required when the Addendum is used. If EU GDPR also applies, the EU SCC assessment remains a separate conclusion under EU law.
Specifies the transfer details and review information captured by the IDTA.
EU SCCs + UK Addendum
Keep the signed EU SCCs and Addendum, completed annexes and selections, UK assessment, any EU assessment, supplementary measures, approvals, and review triggers.
Explains the contract and assessment records needed for the transfer.
Practical decision rule
Which route should the exporter choose?
Choose the IDTA when a standalone UK transfer agreement fits the contract.
Choose the 2021 EU SCCs with the UK Addendum when the parties want one SCC-based package for UK and EEA data flows, or already use the EU SCCs.
Before signing either route, confirm the restricted-transfer analysis, complete all required contract fields, perform the UK assessment, add necessary protections, and identify review triggers.
Supports the separate UK assessment and safeguard requirements.
1
Section 1
Decide whether a transfer contract is needed
Start with the ICO's three-step restricted-transfer test: the UK GDPR must apply to the sender's processing, the sender must initiate and agree to send or make personal information accessible to a separate organisation, and the receiver must be located outside the UK or covered by an applicable exception to the location rule. Remote access can be a transfer; sending data within the same legal entity is not a .
If the transfer is restricted, first check whether UK approval regulations cover the destination and transfer type. If they do not, consider an Article 46 safeguard such as the IDTA or Addendum. Article 49 exceptions are limited routes for specific situations, not a routine substitute for a safeguard.
Map the sender, receiver, locations, legal entities, data, purposes, frequency, onward transfers, and remote-access paths.
Record why the transfer is or is not restricted and why any approval regulation or exception covers the actual transfer.
If Article 46 is used, identify the safeguard and complete the reasonable and proportionate assessment required by the current UK text.
Do not assume that a processor contract under Article 28, an EU SCC contract, or a vendor's security certificate supplies the UK transfer safeguard by itself.
Sets the binding UK rules for approval regulations, appropriate safeguards, the data protection test, and exceptions.
2
Section 2
Complete the chosen contract and assessment
The IDTA has four parts. Part 1 identifies the parties, transfer details, personal information, and security requirements; Part 4 contains the mandatory clauses. Parts 2 and 3 can add extra protection and commercial terms. The Addendum identifies the parties and the approved EU SCCs, modules, selections, and appendix information that it modifies for UK law.
Both parties must ensure that the contract details are accurate and comply with the contractual obligations. The exporter should also retain the transfer facts, destination analysis, assessment conclusion, any supplementary technical or organisational measures, approvals, and review triggers. Reassess when the parties, purposes, data, destination law, government-access risk, onward transfers, or safeguards materially change.
Do not omit required IDTA Part 1 information or make changes to Part 4 beyond the changes the instrument permits.
For the Addendum, identify the correct 2021 EU SCC module and complete the incorporated SCC annexes as well as the Addendum tables.
Keep the Article 28 processor terms distinct where needed; the transfer instrument does not automatically replace every processor-contract requirement.
Document which evidence supports the UK assessment and, if EU GDPR also applies, keep the EU SCC transfer-impact assessment as a separate legal conclusion.