International Data processing

Are you compliant with Data Protection Law

The way international data processes and transfers are made from the UK is about to change. This is part of a series of measures to make UK laws fit for purpose now that we have left the EU. The new legal mechanism is based on a very different criteria to the EU version. The new measures are complex and likely to cause uncertainty and a greater level of risk to non-compliance.

EU Standard Contractual Clauses (SCCs)

Up until now if you needed to transfer data including storing data outside of the UK/EU/EEA your most likely remedy would be to use the EU Standard Contractual Clauses (SCCs). In more recent times the EU revised such safeguards and issued three new versions. The ICO pointed out at the time that UK Data Controllers should not use the new clauses and wait until it announced the UK arrangements. So in short we have been waiting for further direction.

From 21st March 2022

It has now been announced that from the 21st March 2022 the UK will use International Data Transfer Agreements (IDTA) to support transfers outside of the UK. They will not be required if the country to which you are sending the data is EU Adequate, although the UK is developing its own Adequacy Regime. So as it stands, this includes all of the EU countries and the EEA countries until further notice. However, most likely if you use a CRM system the country of concern will be the US. If this is the case this information will apply.

Please see the link below for the ICO's webinar 'Keep Data Flowing'
If you require further advice concerning compliance with data protection law, please get in touch with us


We are the only trusted supplier to The National Council of Voluntary Organisations (NCVO), and work with multiple other reputable organisations.

Get in touch