International Data Transfer Agreements: When UK Organisations Need One, and What Your Hosting Provider Changes

An International Data Transfer Agreement (IDTA) is a set of contract clauses, issued by the UK’s data protection regulator, that you sign with an organisation outside the UK before sending it personal data. You usually need one, or the UK Addendum to the EU standard contractual clauses, for a restricted transfer that no UK adequacy regulation, other safeguard or exception covers.

Whether you are making a restricted transfer often comes down to one question: which organisation do you contract with, and where is it established? That is why the choice of hosting provider matters as much as the paperwork, and why a UK sovereign cloud can be a simpler starting point than a stack of transfer agreements.

This article explains the law in general terms and is not legal advice. It reflects the guidance and legislation as checked on 19 October 2026.

What is an International Data Transfer Agreement?

The IDTA is one of two sets of standard data protection clauses that UK organisations can use to protect personal data sent abroad. The regulator, now the Information Commission (formerly the ICO), issued both. They were laid before Parliament on 2 February 2022 and came into force on 21 March 2022.

The second set is the UK Addendum, which you attach to the standard contractual clauses the European Commission issued on 4 June 2021 (the EU SCCs). Signing either one puts contract duties on the sender, called the exporter, and on the receiver, called the importer. It also gives the people the data is about rights they can enforce. The clauses are pre-approved: you fill in the details, but you do not rewrite the protections.

The old EU standard contractual clauses, from before 2021, stopped covering UK transfers on 21 March 2024. If a contract still relies on them, it needs replacing.

The regulator says it will update both documents in the course of 2026, and that you should keep using the current versions until then. Both are built to update automatically when a new version is issued, and the parties agree in advance who may end the agreement if the change substantially increases their cost or risk.

What are UK SCCs?

UK SCCs is an informal name for the IDTA and the UK Addendum, the standard contractual clauses UK organisations use for restricted transfers. UK GDPR calls them “standard data protection clauses”. The EU SCCs on their own do not cover a restricted transfer under UK GDPR.

The legal basis is Article 46 of UK GDPR, which lists the safeguards you can rely on. Paragraph 2(d) covers standard data protection clauses issued under section 119A of the Data Protection Act 2018, the route the IDTA and the Addendum took. The other safeguards include binding corporate rules for corporate groups, approved codes of conduct and certification schemes, arrangements involving public bodies, and clauses the regulator authorises case by case.

How is the IDTA structured?

The IDTA has four parts. Part 1 is a set of tables you must always complete. Parts 2 and 3 are optional clauses for extra protections and commercial terms. Part 4 holds the mandatory clauses, the core IDTA data protection obligations, which you include but cannot change except as Part 4 itself allows. The current text is version A1.0 of the IDTA, in force since 21 March 2022.

In Table 2, the status boxes record whether each party is a controller, a processor or a sub-processor, which decides what else the contract must cover. The review dates set how often both parties review the security requirements: at a fixed interval, or each time the data, the purposes or the risk assessment change.

Part 2 is where the results of your transfer risk assessment go, as extra technical, organisational or contract protections. Commercial clauses, such as the Article 28 processor terms, can go in Part 3. If Part 1 is incomplete, or Part 4 is changed beyond what its Section 5 allows, the regulator says the IDTA is no longer a valid safeguard.

The UK Addendum (version B1.0) has two parts. Part 1 has four tables: the parties, the EU SCC modules and clauses you are using, the appendix information (including, for some modules, the list of sub-processors) and who may end it when the approved Addendum changes. Part 2 holds the mandatory clauses.

How do you complete an IDTA, step by step?

Start only once you know the transfer is restricted and that a safeguard, rather than adequacy regulations or an exception, will cover it. Then complete the transfer risk assessment, fill in the Part 1 tables, add any extra protections the assessment calls for and sign before any data moves. Both parties must make sure the details are correct.

1. Put the processor contract in place first. If the importer is your processor, Section 1.4 of the IDTA requires a linked agreement that meets Article 28 of UK GDPR, in place on or before the start date.
2. Ask the importer for its “Importer Information”. Under Section 8.3, it must tell you before it receives any data about local laws and practices that affect the protection of the data.
3. Complete the transfer risk assessment, described below, and note the extra protections it calls for.
4. Fill in Tables 1 to 4, add the extra protections to Part 2, and include Part 4 in full or by reference, using the exact wording the regulator publishes. You do not have to use the table layout, as long as your contract gives the same information.
5. Sign so that it binds both parties. Record the transfer in your Article 30 records where you keep them, and tell people about it in your privacy information.
6. Put the review dates in the diary. Under Section 9.2, if the IDTA stops giving enough protection, the parties must pause transfers and agree a change. If they cannot agree one, the exporter must end the IDTA.

Should you use the IDTA or the UK Addendum to EU SCCs?

Either can cover any UK restricted transfer, so the choice is practical. The IDTA suits UK-only transfers and organisations that want one UK document. The UK Addendum to EU SCCs suits you if you, or the receiver, already use the EU SCCs, because one set of clauses then covers EU and UK data. You can use the Addendum even if you only operate under UK GDPR.

When does a transfer count as restricted?

A restricted transfer is personal data sent to, or made accessible to, a separate organisation outside the UK. The Information Commission’s three-step test asks:

1. Does UK GDPR apply to your processing of the data?
2. Are you initiating the transfer of personal data to an organisation located outside the UK? That includes making the data accessible to it, for example by giving it remote access.
3. Is that organisation a separate legal entity from yours?

If the answer to all three is yes, it is a restricted transfer. Initiating means making the decision that causes the transfer to happen. When your provider chooses an overseas sub-processor, the provider initiates that transfer.

The important word is located. The regulator means where the receiving organisation is established, not where the data physically sits. Three of its examples show how that plays out:

• Remote support counts. A UK business keeps its data on UK servers, but an IT support company in India can reach it by VPN. A restricted transfer happens when that company accesses the data, so a transfer mechanism must already be in place when access is given.
• Your own staff do not. Employees of the same company logging in from abroad are not a restricted transfer, because they are part of the same legal entity. Your security duties still apply. A contractor abroad, such as a sole trader, is a separate entity, so their access is a restricted transfer.
• Sub-processors count, for your provider. If a UK provider subcontracts to a company outside the UK, the provider is making a restricted transfer, and it has to cover it.

Some flows are not restricted transfers at all. Data that is only routed through another country on its way between two UK organisations is in transit, not transferred. Data coming into the UK is an inbound transfer, and sending people their own data, for example in reply to a subject access request, is outside the rules.

What are UK adequacy regulations, or data bridges?

UK adequacy regulations, also called data bridges, are regulations in which the UK government approves transfers to a country, territory, sector or international organisation. It must first judge that protection there is not materially lower than in the UK. If one covers your transfer, you need no IDTA, no Addendum and no transfer risk assessment.

Since 5 February 2026, Article 45A of UK GDPR has described these as transfers “approved by regulations”. Adequacy can be full, covering every transfer to a destination, or partial, covering only some sectors, organisations or types of data. The regulator’s list of UK adequacy regulations, in guidance last updated on 30 July 2026, showed the following when we checked it on 19 October 2026.

Adequacy does not switch off your other duties. The regulator still expects reasonable and proportionate checks that the receiver will meet its obligations under its local law, and you still need an Article 28 contract if the receiver is your processor. For partial adequacy, check the scope first. A Canadian government department, for example, falls outside the Canadian regulations, because PIPEDA covers only private sector organisations in commercial activities.

How does the UK-US data bridge work?

The UK-US data bridge, which the regulator calls the UK Extension to the EU-US Data Privacy Framework, has been in force since 12 October 2023. It lets you send personal data to a US organisation without an IDTA. That organisation must appear on the Data Privacy Framework List, have signed up to the UK Extension, hold an active status and be certified for the type of data you send.

Its formal title is the Data Protection (Adequacy) (United States of America) Regulations 2023. Certification covers human resources data, other data, or both. Only US organisations regulated by the Federal Trade Commission or the Department of Transportation can join, which leaves out telecoms companies and many financial institutions. Journalistic data cannot cross the bridge. Genetic data, biometric data used to identify people, data about sexual orientation and criminal offence data must be identified to the US organisation as sensitive before you send them.

Participants self-certify every year, so check the list when you start and at intervals afterwards. On 30 July 2026 the regulator updated its UK Extension guidance to make clear that the UK Extension stands apart from the EU’s own finding for the US. A European court ruling against the EU framework would not end it automatically. If the US organisation is not certified, or not for your data, you need a safeguard such as the IDTA or the Addendum, plus a transfer risk assessment, or an exception.

What is the data protection test?

The data protection test is the standard a transfer must meet before you rely on the IDTA, the Addendum or another safeguard. You must decide, acting reasonably and proportionately, that the protection for people’s data after the transfer is “not materially lower” than under UK data protection law, taken as a whole. It has applied since 5 February 2026.

The test comes from the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. Its international transfer provisions, section 85 and Schedule 7, came fully into force on 5 February 2026 under commencement regulations (SI 2026/82). They rewrote the UK GDPR international transfers rules in Chapter 5, replacing Articles 44 and 45 with new Articles 44A to 45C and amending Article 46. What is reasonable and proportionate depends on all the circumstances, including the nature and volume of the data.

Article 44A now sets out the three routes plainly. A transfer must be approved by adequacy regulations, made subject to appropriate safeguards, or made under an exception.

The regulator still calls the exercise a transfer risk assessment (TRA). Its guidance on what a TRA is says a TRA completed under its old guidance, which found the protection sufficient, meets the new test. You do not need to redo it because the wording changed.

An IDTA or Addendum only becomes “appropriate safeguards”, in the regulator’s words, when three things are done: you have completed the TRA, you have put in place any extra protections it identified, and the agreement has been signed so that it binds both parties.

How do you complete a transfer risk assessment?

A transfer risk assessment checks whether, with your safeguard in place, people’s data will still be protected to a standard not materially lower than in the UK once it reaches the receiver. The regulator accepts three methods: its own TRA tool, the European Data Protection Board’s approach, or, for the US, the UK government’s published analysis. Whichever you use, the level of detail must be reasonable and proportionate.

The assessment looks at two kinds of risk. One is third parties in the destination country, including public bodies, reaching the data outside the safeguard. The other is difficulty in enforcing the safeguard. In outline:

1. Map the transfer: what data, how much, who receives it, where they are established and who else they pass it to.
2. Check whether you need a safeguard at all: adequacy regulations or an exception may already cover the transfer.
3. Choose the safeguard: the IDTA, or the Addendum alongside the EU SCCs.
4. Assess the destination: use the TRA tool, the EDPB approach or, for the US, the UK government’s analysis, to judge whether protection stays not materially lower.
5. Add extra protections the assessment points to: for example encryption, tighter access controls or extra contract clauses.
6. Sign, record and review: sign the agreement before any data is sent or made accessible, keep the assessment on file and review it regularly (the regulator suggests once a year for most ongoing transfers) and whenever the transfer or the law changes.

The regulator’s tool works through six questions, from the circumstances of the transfer and the risk level of the data to whether people could enforce the safeguard. The last asks whether an exception covers any data the safeguard does not protect well enough. Its appendix gives starting risk scores of low, moderate or high for common types of data, which you can adjust.

For a US receiver that is not certified, the regulator’s guidance on completing a TRA lets you rely on the Department for Science, Innovation and Technology’s analysis of US law. You can record that in a short passage at the end of Part 1 of the IDTA or the Addendum. One TRA can cover a series of connected or similar transfers, as long as it accounts for any differences between them.

If the assessment shows the safeguard cannot give enough protection for the data, you must not make the transfer on that basis. You can add protections and assess again, rely on an exception for the data at risk, or not send it.

What exceptions allow a transfer without an IDTA?

Article 49 of UK GDPR lists eight exceptions, which the law calls derogations, for transfers that no adequacy regulation or safeguard covers. The regulator says regular and predictable, or systematic, transfers are less likely to qualify, so an exception is a poor fit for an ongoing hosting or support contract. The eight are:

• the person has explicitly consented, after being told the risks;
• the transfer is necessary for a contract with the person, or for steps they asked for before one;
• it is necessary for a contract made in the person’s interest with someone else;
• it is necessary for important reasons of public interest recognised in UK law;
• it is necessary to establish, make or defend legal claims;
• it is necessary to protect someone’s vital interests when the person is physically or legally unable to consent;
• it is made from a public register, within the register’s rules;
• it is a one-off transfer necessary for compelling legitimate interests that the person’s rights do not override.

The last one is a last resort, available only when no other route applies. The transfer must not be repetitive and must concern a limited number of people. You must assess the circumstances and provide suitable safeguards, then tell the Information Commission and the people concerned. Public authorities cannot use consent, the two contract exceptions or the one-off route when exercising their public powers. Whatever you rely on, document why.

Do you need an IDTA for your situation?

Use the table below as a first check. Find the row closest to your set-up, then confirm the detail against the regulator’s guidance and your contracts. The rows assume UK GDPR applies to you and that the data is personal data.

The regulator’s storage guidance is blunt about the third row. If your storage provider is a UK company, you are not making a restricted transfer, even if its servers are outside the UK. If the provider is located outside the UK, you are making one, even if its servers are in the UK.

How do sub-processors work under UK GDPR?

A sub-processor (GDPR’s own wording is “another processor”) is a processor that your processor engages to carry out part of the work for the controller. Under Article 28 of UK GDPR, your processor needs your prior written authorisation to use one, and must pass on the same data protection obligations. When a UK processor chooses a sub-processor abroad, the processor makes that restricted transfer.

Article 28 gives the controller two ways to authorise: specific, for a named sub-processor, or general. With general authorisation, the processor must tell you about any intended addition or replacement, so that you can object. It must impose the same data protection obligations on the sub-processor by contract, and it stays fully liable to you if the sub-processor fails to meet them.

For transfers, the regulator’s rule of thumb is to follow the contracts: the organisation that designed the transfer and chose the receiver initiates it. The same applies when a provider sells you a packaged service built from several suppliers: it initiates those transfers and must cover them, for example with the IDTA and a TRA. If you hold separate contracts with two processors and tell one to send data to the other abroad, you initiate that transfer yourself.

Your job as controller does not end with authorising. You must still make reasonable and proportionate checks that your processor’s transfers comply, including that it has completed a TRA, as part of the “sufficient guarantees” Article 28 requires.

How do the transfer rules apply to common hosting set-ups?

Three questions decide each case: who receives the data, where that organisation is established and who chose it. The table applies them to four common set-ups, using the regulator’s own examples where it gives one. In every case your Article 28 processor contract applies as well, whatever the transfer answer.

The offshore support desk is easy to miss, because the data never leaves UK servers.

The US SaaS tool turns on two checks: which company you contract with, and whether it is certified. In the regulator’s worked example, a UK company using an uncertified US HR platform signs the IDTA the provider already uses and documents its TRA by relying on the government’s US analysis. If you contract with a UK subsidiary instead, the leg between you is not restricted, but the subsidiary may make its own transfers to group companies abroad.

The reverse also catches people out. If your contract is with the overseas company and only the delivery runs through its UK subsidiary, you are still making a restricted transfer, as in the regulator’s example of a Dutch marketing firm.

The EU backup provider needs no transfer paperwork, but it still needs a processor contract and a check of its own sub-processors. Our guide to the 3-2-1 backup rule covers where an offsite copy fits in a backup plan. The UK provider with UK-only sub-processors stays the simplest case only while that remains true, which is why the Article 28 notice of new sub-processors matters.

Does hosting in the UK remove the need for an IDTA?

Hosting in the UK does not decide it on its own. Contracting with a UK-established provider means there is no restricted transfer between you and the provider. But if a separate company outside the UK can reach the data, such as an overseas support contractor, a parent or group company, or a sub-processor, the provider makes a restricted transfer of its own.

The provider’s own employees working abroad do not count, because they are part of the same legal entity. Where a separate overseas company is involved, the provider must cover that transfer, and as the controller you should still check that it does.

There is a second question the transfer rules do not answer: ownership. If you contract with the UK subsidiary of a US company, and its parent never receives or accesses the data, there is no restricted transfer under these rules. If the parent’s IT team can reach the data, the subsidiary is making a restricted transfer to its parent.

Either way, the parent can still be subject to US law, including the CLOUD Act. That is a question of data sovereignty: UK law, or another country’s law, deciding who can demand the data. It sits apart from the transfer rules, and we cover it in our white paper on cloud sovereignty.

What should you ask your hosting provider?

Ask questions that map onto the three-step test: who you contract with, who else can reach the data and where each of them is established. Get the answers in writing, ideally in the contract or its schedules, so that any change has to be notified to you.

1. Which legal entity do we contract with, and in which country is it registered?
2. Where are our data, backups and any replicas stored?
3. Who provides support, and does any of it come from a separate company outside the UK, such as a group company or contractor?
4. Which sub-processors do you use, where is each one established, and what covers any transfer to them?
5. Where you rely on the IDTA or the Addendum for a sub-processor abroad, have you completed a transfer risk assessment, and will you share a summary?
6. How will you tell us before you add or replace a sub-processor, and how long do we have to object?
7. If any supplier relies on the UK-US data bridge, is it certified, and for which types of data?

For a company, the regulator treats the place of establishment as the country where it is registered. That is why the first question asks for the registered entity rather than a brand name.

Where can you download the IDTA template?

Download the IDTA template and the UK Addendum from the regulator’s IDTA and Addendum page, which offers each as a PDF and as a Word document. Use those versions rather than copies from elsewhere, so that you start from the current text.

The page sits within the ICO international transfers guidance, which the Information Commission still publishes at ico.org.uk under the old name. The same guidance holds the TRA tool, a template document built around the six questions, and an interactive tool based on the three-step test. The IDTA page also gives the exact wording for bringing in the mandatory clauses by reference. Check it for a new version before you sign, as updates are planned during 2026.

How BlackBox Hosting can help

BlackBox Hosting Limited is a UK company, registered in England, and runs managed private and sovereign cloud in UK data centres. Our Backup as a Service keeps backups on UK-based servers, and our G-Cloud 15 service, Sovereign Cloud Virtual Servers, states that data is stored and processed in the UK. Public sector buyers can read our guide to G-Cloud 15 before they buy.

Talk to an expert about where your data sits and who can reach it.

Frequently asked questions