# Standards and Regulatory References

## Primary Legislation

### UK GDPR
- Regulation (EU) 2016/679 as retained in UK law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.
- Chapter V (Articles 44-49) governs restricted transfers from the UK.
- Article 46(2)(c): Standard data protection clauses issued by the Commissioner (IDTA) or adopted by the Commission (EU SCCs with UK Addendum) constitute appropriate safeguards.

### Data Protection Act 2018 (DPA 2018)
- **Section 17A**: Power of the Secretary of State to make adequacy regulations for countries, territories, sectors, or international organisations.
- **Section 75**: Transfers of personal data to third countries by competent authorities (law enforcement context).
- **Section 119A**: Power for the Secretary of State to approve standard data protection clauses by regulations.

### The International Data Transfer Agreement (Approved 2 February 2022)
- Laid before Parliament under Section 119A DPA 2018.
- Effective from 21 March 2022.
- Mandatory clauses cannot be amended; Tables 1-4 completed by the parties.
- Includes built-in TRA requirement through Extra Protection Clauses.

### The International Data Transfer Addendum to the EU SCCs (Approved 2 February 2022)
- Also effective from 21 March 2022.
- Appended to EU SCCs (Commission Decision 2021/914) to extend coverage to UK GDPR-governed transfers.
- Tables 1-4 reference and supplement the EU SCC annexes.

## ICO Guidance

### ICO International Transfer Risk Assessment Tool (Published March 2022)
- Step-by-step methodology for assessing whether a restricted transfer provides essentially equivalent protection.
- Covers destination country assessment, transfer-specific risk, and determination of additional safeguards.
- Available as an interactive online tool on the ICO website.

### ICO Guide to International Transfers (Updated 2024)
- Comprehensive guidance on UK transfer rules, adequacy regulations, IDTA, Addendum, and derogations.
- Clarifies that organisations may use either the IDTA or the Addendum — both are equally valid.
- Provides worked examples for common transfer scenarios.

### ICO Transitional Provisions
- Transfers relying on EU SCCs adopted under Directive 95/46/EC could continue until 21 March 2024.
- From 21 March 2024, all UK restricted transfers must rely on: adequacy regulations, the IDTA, the UK Addendum, or a derogation.

## UK Adequacy Regulations

### The Data Protection (Adequacy) (EEA and Gibraltar) Regulations 2019
- Established the bridging mechanism ensuring EU/EEA countries are treated as adequate for UK transfer purposes post-Brexit.
- Sunset clause originally set for June 2025; extended by statutory instrument.

### The Data Protection (Adequacy) Regulations 2023
- Consolidated UK adequacy assessments for 13 countries and territories.
- Includes the UK Extension to the EU-US DPF (UK-US Data Bridge) effective 12 October 2023.

## Enforcement Precedents

### ICO — Clearview AI Inc (May 2022)
- ICO fined Clearview AI GBP 7,552,800 for processing UK residents' data without lawful basis and without appropriate transfer safeguards.
- Demonstrated ICO willingness to enforce against non-UK entities processing UK personal data.

### ICO — Enforcement Notice to UK Government Department (2023)
- ICO issued an enforcement notice to a government department for transferring personal data to a non-adequate country without a valid transfer mechanism.
- Required the department to implement IDTAs or Addenda within 90 days.

## UK-US Data Bridge

### UK-US Data Bridge Adequacy Regulations 2023
- Effective 12 October 2023.
- Extends DPF self-certification to UK-to-US transfers.
- US organisations must opt into the "UK Extension" on the DPF List.
- Same DPF Principles, IRM requirements, and DPRC redress apply.
- ICO designated as the UK supervisory authority for complaint referrals.