A blog by Emma Bate
17 November 2022
It’s important that businesses and organisations know how to protect people’s personal information when making international transfers, which are central to the increasingly global nature of businesses. Our work in this area aims to provide certainty, for all involved, that the right level of protection is in place. This blog and associated products is aimed at all businesses and organisations which transfer data internationally, and civil society.
What we have published
Earlier this year we published the International Data Transfer Agreement (IDTA) and the Addendum to the European Union Standard Contractual Clauses (SCCs).
Today we have published an update to our guidance on international transfers. This includes a new section on transfer risk assessments (TRAs) and a TRA tool.
How it will help
Our TRA guidance clarifies an alternative approach to the one put forward by the European Data Protection Board. Our aim is to find an alternative, achievable approach delivering the right protection for the people the data is about, whilst ensuring that the assessment is reasonable and proportionate.
To do this, we created a six question TRA tool with guidance and tables to help people work through it. It gives an initial risk level for categories of data, and we have moved the focus to whether the transfer significantly increases the risk of either a privacy or other human rights breach. We believe this captures the key risk to the people the data is about, and is also achievable.
What is coming next
We are working on guidance showing you how to use the IDTA and the Addendum to the SCCs (including clause by clause guidance). We are also considering extending the TRA guidance to include worked examples to show how the TRA tool can work in practice.
We remain keen to listen to your experiences of using our guidance and TRA tool, and will be holding sessions next year to learn from you so that we can continuously improve our products.
Emma Bate is the Director of Legal Services (Regulatory Advice & Commercial)
