The UK wrote its own transfer clauses, not the EU's

The workload

A UK exporter of personal data has to pick one of two documents the Information Commissioner's Office issued for the purpose the EU's Standard Contractual Clauses serve for an EU exporter, and the ICO's own guidance treats picking the wrong one as a real risk, not a formality. Its page on standard data protection clauses, a living document retrieved 16 September 2026, names two instruments: the International Data Transfer Agreement (IDTA), a standalone UK contract, and the International Data Transfer Addendum, which the same page describes as an addendum to the SCCs the European Commission issued on 4 June 2021 rather than a document in its own right.

What the documents show

Verified, from the ICO's own page: both instruments were laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022. Verified: the ICO frames the choice as practical rather than legal; the Addendum 'may appeal to you if you operate in both the UK and the EEA' and already use the EU SCCs for European flows, since attaching the Addendum avoids running two separate contract sets for the same transfer chain, and a UK-only exporter can use the Addendum with the EU SCCs without transferring any data under the EU GDPR at all. Verified: the IDTA stands alone and does not require the EU SCCs as a base document. This entry treats the IDTA and the Addendum as two distinct instruments serving the same legal function, matching the distinction the ICO's own guidance draws, rather than as a UK-issued version of the EU clauses covered elsewhere on this site.

The operating cost

Neither document carries a stated filing fee; the cost is legal and drafting time to select and complete the correct instrument, plus the ongoing burden the ICO's guidance places on any restricted transfer: a transfer risk assessment showing the destination country's law does not undermine the protection the clauses promise. The documents cited here do not quantify that assessment's cost, and this entry does not estimate one the ICO has not itself provided.

The stop condition

Editorial: the obligation to rely on one of these instruments ends only if the transfer itself stops, or if the destination becomes covered by a UK adequacy regulation the ICO's guidance addresses separately from the IDTA and Addendum pages cited here.

• Does the business already rely on the EU SCCs for European flows, making the Addendum the lower-friction choice over a standalone IDTA?
• Was the transfer risk assessment the ICO's guidance calls for actually completed and kept on file, not just the signed clauses?
• Has the guidance been rechecked since 16 September 2026, given the ICO's appropriate-safeguards index is a living document?

The ICO built two doors into the same room; which one a business uses depends on whether it is already standing in the EU SCC room next door, not on which document sounds more official.