Guides implementation of UK international data transfer mechanisms post-Brexit including the International Data Transfer Agreement (IDTA), UK Addendum to EU SCCs, UK adequacy assessments, and ICO transfer risk assessment tool. Keywords: UK IDTA, UK addendum, ICO TRA, post-Brexit transfers, UK GDPR.
Following the UK's exit from the EU, the UK operates its own international data transfer regime under the UK GDPR (as retained and amended by the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019). The Information Commissioner's Office (ICO) has developed two instruments for international transfers: the International Data Transfer Agreement (IDTA), effective 21 March 2022, and the UK Addendum to the EU SCCs. The UK also maintains its own adequacy assessment framework independent of the European Commission's adequacy decisions.
The IDTA is a standalone UK transfer mechanism that does not rely on the EU SCCs. It is laid before Parliament as a statutory instrument under Section 119A of the Data Protection Act 2018.
Structure:
Key features:
The UK Addendum is an alternative to the IDTA that allows organisations already using EU SCCs (Commission Decision 2021/914) to extend those SCCs to cover UK GDPR-governed transfers by adding the Addendum.
Structure:
When to use the Addendum vs. IDTA:
The UK Secretary of State has the power to make adequacy regulations under Section 17A of the Data Protection Act 2018. As of March 2026, the UK has adopted adequacy regulations for:
| Country/Territory | Regulation | Effective Date |
|---|---|---|
| EU/EEA Member States | Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 | 1 January 2021 (bridging mechanism) |
| Andorra | Adequacy Regulations 2023 | 12 October 2023 |
| Argentina | Adequacy Regulations 2023 | 12 October 2023 |
| Canada (PIPEDA organisations) | Adequacy Regulations 2023 | 12 October 2023 |
| Faroe Islands | Adequacy Regulations 2023 | 12 October 2023 |
| Guernsey | Adequacy Regulations 2023 | 12 October 2023 |
| Israel | Adequacy Regulations 2023 | 12 October 2023 |
| Isle of Man | Adequacy Regulations 2023 | 12 October 2023 |
| Japan | Adequacy Regulations 2023 | 12 October 2023 |
| Jersey | Adequacy Regulations 2023 | 12 October 2023 |
| New Zealand | Adequacy Regulations 2023 | 12 October 2023 |
| South Korea | Adequacy Regulations 2024 | 2024 |
| Switzerland | Adequacy Regulations 2023 | 12 October 2023 |
| Uruguay | Adequacy Regulations 2023 | 12 October 2023 |
| United States (UK-US Data Bridge) | Adequacy Regulations 2023 | 12 October 2023 |
The UK-US Data Bridge extends the DPF self-certification mechanism to UK-to-US transfers:
The ICO has published a Transfer Risk Assessment tool to assist organisations in evaluating whether a transfer provides an essentially equivalent level of protection to that under UK law.
Evaluate the destination country's laws and practices against four factors:
| Factor | Assessment Questions |
|---|---|
| Respect for rule of law and human rights | Does the country have a functioning, independent judiciary? Is there an independent data protection authority? |
| Data protection legislation | Does the country have comprehensive data protection legislation? Does it provide individual rights equivalent to UK GDPR? |
| Government access to personal data | What laws authorise government access? Are there necessity and proportionality requirements? Is there independent oversight? |
| Enforcement and redress | Can individuals exercise rights against data controllers? Is there an effective complaint mechanism? Can individuals seek judicial redress? |
| Factor | Assessment Questions |
|---|---|
| Sector and entity type | Is the importer in a sector with heightened government access risk (e.g., telecommunications)? |
| Data sensitivity | Does the transfer include special category data or data that creates higher risk if accessed? |
| Volume and frequency | Is this a one-time transfer or ongoing? What volume of data subjects is affected? |
| Importer track record | Has the importer previously received government access requests? |
| Technical protections | What technical measures are in place (encryption, pseudonymisation)? |
Based on the assessment, determine whether the IDTA or Addendum alone provides sufficient protection, or whether Extra Protection Clauses (supplementary measures) are needed.
Document the TRA results and schedule periodic reviews (at least annually or upon trigger events).
| Field | Exporter | Importer |
|---|---|---|
| Party name | Athena Logistics (UK) Ltd | TransPacific Freight Solutions Ltd |
| Contact person | David Morrison, UK Data Protection Manager | James Leung, Chief Privacy Officer |
| Address | 30 Fenchurch Street, London EC3M 3BD, United Kingdom | 88 Harbour Road, Wan Chai, Hong Kong SAR |
| Official registration | Companies House No. 12345678 | Hong Kong Companies Registry CR-987654 |
| Role | Exporter (Controller) | Importer (Processor) |
| Element | Detail |
|---|---|
| Description of transfer | Transfer of UK customer shipment data for Asia-Pacific freight consolidation and customs clearance |
| Purpose | Performance of freight forwarding services for UK-origin shipments to APAC destinations |
| Categories of data subjects | UK shipping customers (consignors), UK-based consignees, customs brokers |
| Categories of personal data | Full name, business email, phone, shipping address, customs IDs, consignment references |
| Special category data | None |
| Frequency | Continuous (real-time API); daily batch at 02:00 UTC |
| Retention | 36 months from shipment completion |
Reference to the Annex II measures from the EU SCC implementation (TLS 1.3, AES-256 encryption at rest, RBAC with MFA, centralised SIEM, ISO 27001-certified facilities).
Extra Protection Clauses mirror the supplementary measures identified in TIA-2025-HK-001:
For organisations like Athena Global Logistics that transfer data under both EU GDPR and UK GDPR, the recommended approach is: