International Data Transfer Agreement

International transfers of personal data out of the UK require a transfer mechanism: an adequacy decision (which covers transfers to the EEA and a small number of other jurisdictions), the International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK Addendum, or one of a few less common alternatives.

Choosing and operating the right transfer mechanism

The right answer depends on where the data is going, what kind of transfer it is, and what other transfer mechanisms the parties may already be relying on.

Beyond the choice of instrument, the parties also need to conduct a transfer risk assessment to demonstrate that the data will be protected to a UK-equivalent standard in the destination, particularly since the Schrems II line of case law. The drafting and the assessment together are what make a transfer compliant.

Required whenever you transfer personal data to a country that does not have a UK adequacy decision.

Example: a typical scope and fixed fee

For a single international data transfer requiring a transfer mechanism, the typical scope looks like this.

What's included

• A consultation to understand the data transfers and recipient countries
• Drafting of the appropriate transfer mechanism (UK IDTA or UK Addendum to EU SCCs)
• Guidance on the transfer risk assessment required under UK GDPR
• One round of revisions based on your feedback
• Final version ready to use

What's outside this scope

• Transfer risk assessments (I can quote for these separately)
• Tax advice

Fixed fee: £395, no VAT.

How I will approach your matter

Once you have instructed me, I will arrange a consultation to understand the data transfers and recipient countries before drafting the appropriate transfer mechanism, together with guidance on the required transfer risk assessment.

Common questions

When is an international data transfer agreement needed?

Whenever personal data is transferred outside the UK to a country that does not have a UK adequacy decision, you need a lawful transfer mechanism in place. This includes transfers to service providers, group companies, or partners based outside the UK.