The ICO has launched a public consultation on its draft international data transfer agreement (IDTA) and guidance.

The ICO explains that when organisations send personal information to a country outside the UK, they must ensure people’s data protection rights continue to be protected. An IDTA is a contract that organisations can use when transferring data to countries not covered by adequacy decisions.

The IDTA will replace the current standard contractual clauses (SCCs) to take into account the judgment of the Court of Justice of the European Union in “Schrems II”. The ruling required organisations to carry out further diligence when making a transfer of personal data outside of the UK to countries without an adequacy decision.

The consultation is split into three sections, offering a selection of proposals and options to consider:

• proposal and plans for updates to guidance on international transfers;
• transfer risk assessments; and
• the international data transfer agreement.

The ICO is also asking for views on any relevant privacy rights, legal, economic or policy considerations and implications. Responses will help the regulator understand the practical impact of proposed approaches on organisations.

The ICO says that the new IDTA will “support the UK’s digital economy by continuing to enable the global flow of people’s information with the safeguards of high standards of data protection”.

Steve Wood, ICO Executive Director of Regulatory Strategy, said: “This consultation is important. We know how important it is for transfer tools to work in practice, and the ICO wants to support businesses in this area. The responses we receive will inform our final work and I encourage all organisations that undertake international transfers to engage with the consultation and provide feedback.”

The ICO’s work around IDTAs, and its consultation, are a requirement under s119a of the Data Protection Act 2018. The consultation will inform the final documents the ICO will lay before Parliament. The consultation will remain open until 5pm on 7 October 2021. To read the ICO’s announcement in full and for a link to the consultation, click here.