Contract analysis

1. Purpose of the Addendum This Addendum extends the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) to cover restricted transfers of personal data under the UK GDPR. Its function is to satisfy the requirements of Article 46 of the UK GDPR by providing "appropriate safeguards" for transfers of personal data from the United Kingdom to a third country t

2. Statutory footing This is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and laid before Parliament on 2 February 2022 pursuant to Schedule 21, paragraph 7 of that Act. It came into force on 21 March 2022. The wording of the Mandatory Clauses (Part 2 below) is prescribed by the ICO

3. When to use this template Two ICO-approved transfer mechanisms are available for restricted transfers under the UK GDPR: (a) the standalone UK International Data Transfer Agreement (IDTA); and (b) the EU SCCs + UK Addendum (this document). This template should be used where the same data flow is subject to both the EU GDPR and the UK GDPR (for example, group intra-affiliate flows out of both the EEA and the UK), o

4. Modules addressed The Addendum operates in respect of any of Modules 1 to 4 of the EU SCCs: • Module 1 — Controller to Controller • Module 2 — Controller to Processor • Module 3 — Processor to Processor • Module 4 — Processor to Controller The underlying EU SCCs must be completed in full — including selection of the relevant Module, completion of the Appendix, and execution by the parties — before the Addendum tab

5. Approach to completing the tables The engagement lawyer should:

1. Complete Tables 1 to 4 in Part 1 in full;

2. Verify the defaults and selections in Part 2 and confirm that no impermissible amendments have been introduced;

3. Ensure that Annexes I.A, I.B, I.C, II and (where Modules 2 or 3 apply) III are populated with sufficient granularity;

4. Obtain execution signatures from all Exporter(s) and Importer(s), matching the signatories to the underlying EU SCCs.

6. Transfer Impact Assessment A Transfer Impact Assessment (TIA) must be completed prior to execution of the Addendum. The TIA should assess the laws and practices of the destination jurisdiction relevant to third-country access to personal data (following the Schrems II line of authority as read into UK law), identify any supplementary measures required, and record the parties' documented conclusion that the transfe

7. Legislative watch Check for legislative and regulatory updates before deploying the template on any new matter — including any UK data protection reform legislation, ICO guidance updates, and any Revised Approved Addendum issued by the ICO under section 119A(4) DPA 2018. Refresh the template on each annual review cycle.

8. Housekeeping. Delete all italicised drafting notes and internal guidance before execution. Parties Identification Block To be completed for each transaction. Where there are multiple Exporters or Importers, replicate the relevant sub-block. Exporter. Importer. PART 1 — TABLES Table 1: Parties Start date: [Insert] The Parties: Drafting note: Where there is more than one Exporter or more than one Importer, extend th

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of t

3. Entering into this Addendum incorporates the Approved EU SCCs by reference, amended and interpreted as set out in Section 18 and elsewhere in this Addendum. Interpretation of this Addendum

4. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

5. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties' obligation to provide the Appropriate Safeguards.

6. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws ap

7. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the Parties, the Parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.

8. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

9. Where this Addendum incorporates Addendum EU SCCs which have also been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs. Incorporation of and changes to the EU SCCs

10. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that: (a) together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter's processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers; (b) Sections 9 to 11 override Clause 5 (Hie

11. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply. The specified amendments to the Approved EU SCCs which are effected by Section 10 of the Approved Addendum include, without limitation: (a) references to the "Regulation (EU) 2016/679" or "that Regulation" are replaced by "UK Data Protection Laws" and references to specific Art

12. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

13. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

14. No amendments to the Approved Addendum or the Addendum EU SCCs are permitted, save as set out in Sections 12 and 13 or to fill in the blanks and to select options which are set out in the Approved Addendum.

15. If the Parties wish to modify the Approved Addendum in any way not permitted by Sections 12–14, the Parties must instead use the Approved IDTA (the UK International Data Transfer Agreement) or another mechanism providing Appropriate Safeguards.

16. If the provisions included in Sections 10 to 15 conflict with any other provision of this Addendum, Sections 10 to 15 will prevail.

17. No Party shall provide or publish any information about this Addendum, the Approved EU SCCs or the underlying Restricted Transfer in any manner which is inconsistent with the ICO's approved use of the Addendum. Review of this Addendum

18. The Parties must review this Addendum, the Addendum EU SCCs and the Appendix Information from time to time to ensure that they continue to provide the Appropriate Safeguards and are otherwise fit for purpose. In particular, the Parties will consider whether any change to UK Data Protection Laws, to any relevant guidance issued by the ICO, or to the ICO's Approved Addendum (whether by way of a Revised Approved Add

19. Where the ICO issues a Revised Approved Addendum under Section 18: (a) if the Parties have selected in Table 4 "Neither Party", the Parties will automatically be bound by the Revised Approved Addendum from the date specified by the ICO, without further action or agreement of the Parties; (b) if the Parties have selected in Table 4 that either or both of the Importer and Exporter may end this Addendum, the Revised

20. On termination of this Addendum (howsoever arising), the Importer shall, at the Exporter's election and in accordance with the terms of the Approved EU SCCs (in particular, Clause 8.5 for Module Two and Module Three and equivalent provisions of the other Modules), return to the Exporter or delete all personal data transferred under the Addendum, and shall certify such return or deletion to the Exporter. This obli

1. Transfer Impact Assessment. A TIA has been completed and is on the deal file. The TIA identifies the destination jurisdiction, considers the third-country access laws and practices in that jurisdiction, and records the parties' documented conclusion (with supplementary measures where required) that the transfer provides an essentially equivalent level of protection. TIA reference: [ ].

2. Underlying EU SCCs. The Approved EU SCCs (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) have been executed by the same parties, with the correct Module(s) selected, and with the Appendix fully populated. Reference to executed EU SCCs: [ ].

3. Identity and capacity of parties. The identity of each Exporter and each Importer has been verified, including corporate name, jurisdiction of incorporation and registration number. The processing capacity of each party (controller / processor / joint controller) has been analysed and correctly reflected in Annex I.A. Any "controller of a controller" or UK-established importer scenarios have been considered and do

4. Supervisory authority position. The ICO has been correctly identified as the competent supervisory authority for the UK-originating flow. Where the same transfer is also subject to the EU GDPR, the competent lead EU supervisory authority has been separately identified in Annex I.C, and any one-stop-shop / lead authority analysis has been performed.

5. Supplementary measures. Any supplementary measures identified in the TIA as necessary have been reflected in Annex II. Where the supplementary measures are contractual (e.g., transparency obligations, government-access reporting), they have been recorded in an accompanying agreement or as bespoke additions to the underlying EU SCCs (not to the Mandatory Clauses).

6. Sub-processors. Where Modules 2 or 3 apply, all sub-processors have been enumerated in Annex III, with sufficient particulars, and the approval mechanism (specific or general) and notification period have been selected in Table 2.

7. Signatory authority. Each signatory has authority to bind the entity on whose behalf they sign. Where the signatory is signing under a power of attorney or delegated authority, the underlying authority has been reviewed and a copy is on file.

8. Execution formalities. The document is executed in duplicate, or a counterparts provision is included in the underlying commercial agreement, and the executed counterparts have been circulated and stored on the deal file. The signatories match those on the underlying EU SCCs. Related Firm Precedents The following firm precedents may be relevant when deploying this template. Refer to each by generic reference only;