# UK International Transfer Implementation Workflow

## IDTA Implementation Workflow

### Phase 1: Preparation (Weeks 1-2)

1. Confirm the transfer is a "restricted transfer" under UK GDPR Chapter V (personal data transferred from UK to a country without adequacy regulations).
2. Identify the parties: exporter (UK-based entity) and importer (third-country entity).
3. Determine the transfer relationship: Controller-to-Controller, Controller-to-Processor, Processor-to-Processor, or Processor-to-Controller.
4. Gather the transfer details: data categories, subjects, purpose, frequency, retention.
5. Decide whether to use the IDTA or the UK Addendum to EU SCCs.

### Phase 2: IDTA Completion (Weeks 2-4)

1. **Table 1 — Parties**: Enter legal names, addresses, contact persons, official registration numbers, and roles.
2. **Table 2 — Transfer Details**: Complete all transfer description fields including purpose, data categories, data subjects, frequency, and retention.
3. **Table 3 — Security Measures**: Document all technical and organisational measures in place for the transferred data. Reference ISO certifications, SOC reports, or internal security standards.
4. **Table 4 — Extra Protection Clauses**: Conduct the TRA and document the results. Identify and record any additional safeguards needed to ensure essentially equivalent protection.

### Phase 3: Transfer Risk Assessment (Weeks 3-5)

1. **Destination country assessment**: Evaluate the legal framework using the ICO TRA tool or equivalent methodology.
2. **Transfer-specific risk**: Assess the specific risks considering data sensitivity, volume, sector, and importer profile.
3. **Gap identification**: Determine whether the IDTA alone provides sufficient protection or whether Extra Protection Clauses are needed.
4. **Supplementary measures**: If needed, identify technical, contractual, and organisational measures.
5. **Document the TRA**: Formal written record with sign-off.

### Phase 4: Execution and Filing (Week 5)

1. Both parties sign the completed IDTA.
2. File the executed IDTA with the data transfer register.
3. Attach the TRA documentation.
4. Set the periodic review date (minimum annually).

## UK Addendum Implementation Workflow

### Phase 1: Verify EU SCCs Exist (Week 1)

1. Confirm EU SCCs (Commission Decision 2021/914) are already executed between the same parties.
2. Identify the selected EU SCC module.
3. Verify EU SCC Annexes I-III are complete.

### Phase 2: Complete Addendum Tables (Weeks 1-2)

1. **Table 1 — Parties**: Reference the EU SCC Annex I.A party details.
2. **Table 2 — Selected SCCs**: Specify the EU SCC module, the date of the EU SCCs, and any clauses where options were selected.
3. **Table 3 — Appendix Information**: Reference the EU SCC Annexes or provide UK-specific variations.
4. **Table 4 — Ending the Addendum**: Select the approach for when the Approved Addendum is changed by the ICO (automatic update or right to terminate).

### Phase 3: TRA for UK Transfers (Weeks 2-3)

1. Conduct the ICO TRA (may differ from the EU TIA if UK legal standards produce different assessments).
2. Document Extra Protection Clauses specific to UK transfer risks.
3. Sign-off by the UK Data Protection Manager.

### Phase 4: Execution

1. Both parties sign the Addendum.
2. The Addendum is appended to the EU SCC document.
3. Filed in the transfer register as a separate UK transfer entry.

## Dual EU-UK Transfer Management Workflow

1. Identify all transfers that originate from both EU entities (Athena Global Logistics GmbH) and UK entities (Athena Logistics (UK) Ltd) to the same importer.
2. Execute a single contractual package: EU SCCs + UK Addendum.
3. Conduct both an EU TIA (per EDPB Recommendations 01/2020) and a UK TRA (per ICO tool).
4. Document both assessments separately — they may reach different conclusions.
5. Maintain separate transfer register entries:
   - EU transfer register: exporter = GmbH, mechanism = EU SCCs Module 2
   - UK transfer register: exporter = UK Ltd, mechanism = UK Addendum to EU SCCs
6. Review both mechanisms on the same annual cycle for efficiency.

## UK Adequacy Verification Workflow

1. Before each transfer, check whether the destination country has UK adequacy regulations.
2. If adequacy exists, document the adequacy regulation reference and proceed without additional mechanism.
3. If adequacy does not exist, establish an IDTA or Addendum.
4. Monitor UK government announcements for new or revoked adequacy regulations.
5. For UK-US Data Bridge transfers, verify the US importer's DPF certification includes the "UK Extension."