UK ADDENDUM TO THE EU STANDARD CONTRACTUAL CLAUSES
TEMPLATE
International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
Issued by the Information Commissioner under Section 119A of the Data Protection Act 2018
Version B1.0 — In force from 21 March 2022
CLASSIFICATION: Confidential — Template
DOCUMENT TYPE: Reusable firm template (blank fillable form)
NOT FOR EXECUTION without transaction-specific tailoring by a qualified data protection practitioner.
Version Control (Cover)
Client / Matter Identifier
This document is a firm template. It is confidential and privileged. It is not to be executed, released to a counterparty, or held out as a bespoke advice product without transaction-specific tailoring. All italicised drafting notes and internal guidance must be removed prior to execution.
Template Use Notes — Drafting Guidance
To be deleted before execution.
1. Purpose of the Addendum
This Addendum extends the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) to cover restricted transfers of personal data under the UK GDPR. Its function is to satisfy the requirements of Article 46 of the UK GDPR by providing "appropriate safeguards" for transfers of personal data from the United Kingdom to a third country that has not been the subject of an adequacy regulation.
2. Statutory footing
This is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and laid before Parliament on 2 February 2022 pursuant to Schedule 21, paragraph 7 of that Act. It came into force on 21 March 2022. The wording of the Mandatory Clauses (Part 2 below) is prescribed by the ICO and may not be modified.
3. When to use this template
Two ICO-approved transfer mechanisms are available for restricted transfers under the UK GDPR:
(a) the standalone UK International Data Transfer Agreement (IDTA); and
(b) the EU SCCs + UK Addendum (this document).
This template should be used where the same data flow is subject to both the EU GDPR and the UK GDPR (for example, group intra-affiliate flows out of both the EEA and the UK), or where the parties have a strong preference for aligning the substantive drafting with the EU SCCs already in operation across the group. Where the transfer is UK-only and there is no EU footprint, the standalone UK IDTA may be simpler.
Refer to the firm's International Transfers Policy & Mechanism Selection Guidance (reference [ ]) for the decision framework.
4. Modules addressed
The Addendum operates in respect of any of Modules 1 to 4 of the EU SCCs:
• Module 1 — Controller to Controller
• Module 2 — Controller to Processor
• Module 3 — Processor to Processor
• Module 4 — Processor to Controller
The underlying EU SCCs must be completed in full — including selection of the relevant Module, completion of the Appendix, and execution by the parties — before the Addendum tables are populated. The Addendum does not stand alone; it is parasitic on a valid, executed set of EU SCCs.
5. Approach to completing the tables
The engagement lawyer should:
1. Complete Tables 1 to 4 in Part 1 in full;
2. Verify the defaults and selections in Part 2 and confirm that no impermissible amendments have been introduced;
3. Ensure that Annexes I.A, I.B, I.C, II and (where Modules 2 or 3 apply) III are populated with sufficient granularity;
4. Obtain execution signatures from all Exporter(s) and Importer(s), matching the signatories to the underlying EU SCCs.
6. Transfer Impact Assessment
A Transfer Impact Assessment (TIA) must be completed prior to execution of the Addendum. The TIA should assess the laws and practices of the destination jurisdiction relevant to third-country access to personal data (following the Schrems II line of authority as read into UK law), identify any supplementary measures required, and record the parties' documented conclusion that the transfer provides an essentially equivalent level of protection. Attach the completed TIA or cross-reference it here: [TIA reference: ______].
7. Legislative watch
Check for legislative and regulatory updates before deploying the template on any new matter — including any UK data protection reform legislation, ICO guidance updates, and any Revised Approved Addendum issued by the ICO under section 119A(4) DPA 2018. Refresh the template on each annual review cycle.
8. Housekeeping. Delete all italicised drafting notes and internal guidance before execution.
Parties Identification Block
To be completed for each transaction. Where there are multiple Exporters or Importers, replicate the relevant sub-block.
Exporter.
Importer.
PART 1 — TABLES
Table 1: Parties
Start date: [Insert]
The Parties:
Drafting note: Where there is more than one Exporter or more than one Importer, extend the table by adding further columns (or rows) for each additional party, replicating the sub-rows above. Ensure the party naming is consistent throughout the Addendum, the underlying EU SCCs, and the Annexes.
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs (select one option by marking [X]):
[ ] The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information:
Date executed: [Insert]
Reference (if any): [Insert]
Parties: [Insert]
Module(s) selected in the Approved EU SCCs: [Insert]
[ ] The Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum: [Insert specification]
Module selection matrix:
Drafting note: Only tick "in operation" for the Module(s) that in fact govern the relationship between the Exporter and Importer. Where the parties act in different capacities in respect of different data flows, more than one Module may be selected. The ICO default notification period for sub-processor changes under Clause 9a is generally not less than 30 days.
Table 3: Appendix Information
"Appendix Information" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum when the Approved Addendum Changes:
Which Parties may end this Addendum as set out in Section 19:
[ ] Importer
[ ] Exporter
[ ] Neither Party
Drafting note: The choice made here determines who bears the risk of a Revised Approved Addendum being issued by the ICO. Selecting "Neither Party" means the Addendum will automatically update to the Revised Approved Addendum and the parties waive the right to terminate on that basis; this favours continuity of the transfer and is often appropriate for intra-group flows. Selecting one or both parties preserves the right to object to a Revised Approved Addendum where the change imposes a substantial, disproportionate compliance burden or has a substantial adverse effect on the commercial position of that party; this is often appropriate for arm's-length commercial arrangements. Consider the commercial sensitivity, the anticipated duration of the transfer, and the cost of switching to an alternative transfer mechanism when advising the client on this election.
PART 2 — MANDATORY CLAUSES
Chapeau. The Mandatory Clauses set out below reproduce Part 2 of the ICO's Approved Addendum verbatim. They are prescribed by the Information Commissioner and cannot be amended, save (i) to fill in blanks and to add options where the Approved Addendum expressly permits and (ii) as expressly permitted by Section 12 (references to the laws and/or courts of Scotland or Northern Ireland). No other changes to the Mandatory Clauses are permitted, and any purported amendment will be void.
Entering into this Addendum
1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
3. Entering into this Addendum incorporates the Approved EU SCCs by reference, amended and interpreted as set out in Section 18 and elsewhere in this Addendum.
Interpretation of this Addendum
4. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:
5. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties' obligation to provide the Appropriate Safeguards.
6. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
Hierarchy
7. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the Parties, the Parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
8. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
9. Where this Addendum incorporates Addendum EU SCCs which have also been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
Incorporation of and changes to the EU SCCs
10. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
(a) together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter's processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
(b) Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
(c) this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
11. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
The specified amendments to the Approved EU SCCs which are effected by Section 10 of the Approved Addendum include, without limitation:
(a) references to the "Regulation (EU) 2016/679" or "that Regulation" are replaced by "UK Data Protection Laws" and references to specific Article(s) of "Regulation (EU) 2016/679" are replaced with the equivalent Article or Section of UK Data Protection Laws;
(b) references to "Regulation (EU) 2018/1725" are removed;
(c) references to the "Union", "EU" and "EU Member State" are all replaced with "the UK";
(d) the reference to "Clause 12(c)(i)" at Clause 10(b)(i) of Module One, is replaced with "Clause 11(c)(i)";
(e) Clause 13(a) and Part C of Annex I are not used, the "competent supervisory authority" and "supervisory authority" are both replaced with the "Information Commissioner";
(f) in Clause 16(e), subsection (i) is replaced with: "the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply";
(g) Clause 17 is replaced to state: "These Clauses are governed by the laws of England and Wales";
(h) Clause 18 is replaced to state: "Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.";
(i) the footnotes to Clauses 8.5(e) and 8.6(d) are not used and the "competent supervisory authority" is replaced with the "Information Commissioner";
(j) in Annex I, Part A:
• "Data exporter(s)": the second, third and fourth bullet points are not used;
• "Data importer(s)": the third bullet point is not used;
(k) in Annex I, Part B: the words "or, for transfers to (sub-) processors, the subject matter, nature and duration of the processing" are added to the "Nature of the processing" bullet;
(l) in Annex II, the wording preceding the "Description of the technical and organisational measures" is not used.
Amendments to this Addendum
12. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
13. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
14. No amendments to the Approved Addendum or the Addendum EU SCCs are permitted, save as set out in Sections 12 and 13 or to fill in the blanks and to select options which are set out in the Approved Addendum.
15. If the Parties wish to modify the Approved Addendum in any way not permitted by Sections 12–14, the Parties must instead use the Approved IDTA (the UK International Data Transfer Agreement) or another mechanism providing Appropriate Safeguards.
16. If the provisions included in Sections 10 to 15 conflict with any other provision of this Addendum, Sections 10 to 15 will prevail.
17. No Party shall provide or publish any information about this Addendum, the Approved EU SCCs or the underlying Restricted Transfer in any manner which is inconsistent with the ICO's approved use of the Addendum.
Review of this Addendum
18. The Parties must review this Addendum, the Addendum EU SCCs and the Appendix Information from time to time to ensure that they continue to provide the Appropriate Safeguards and are otherwise fit for purpose. In particular, the Parties will consider whether any change to UK Data Protection Laws, to any relevant guidance issued by the ICO, or to the ICO's Approved Addendum (whether by way of a Revised Approved Addendum or otherwise) requires the Parties to update this Addendum, and will act reasonably and in good faith to give effect to any such update.
Ending this Addendum when the Approved Addendum Changes
19. Where the ICO issues a Revised Approved Addendum under Section 18:
(a) if the Parties have selected in Table 4 "Neither Party", the Parties will automatically be bound by the Revised Approved Addendum from the date specified by the ICO, without further action or agreement of the Parties;
(b) if the Parties have selected in Table 4 that either or both of the Importer and Exporter may end this Addendum, the Revised Approved Addendum will not replace this Addendum until the earlier of (i) the date on which the Parties agree in writing to adopt the Revised Approved Addendum and (ii) the date [Insert notice period — default 30 days] after the entitled Party has received notice from the ICO of the Revised Approved Addendum, unless the entitled Party gives written notice to the other Party that it objects to the Revised Approved Addendum, in which case the entitled Party may end this Addendum on written notice to the other Party;
(c) the entitled Party may only object to the Revised Approved Addendum where (i) the ICO issues a Revised Approved Addendum which is not made as a direct consequence of a change in UK Data Protection Laws, and (ii) the Revised Approved Addendum imposes a substantial, disproportionate compliance burden or has a substantial adverse effect on the commercial position of that Party, considered against the Approved Addendum as it stood immediately before the Revised Approved Addendum was issued.
Termination
20. On termination of this Addendum (howsoever arising), the Importer shall, at the Exporter's election and in accordance with the terms of the Approved EU SCCs (in particular, Clause 8.5 for Module Two and Module Three and equivalent provisions of the other Modules), return to the Exporter or delete all personal data transferred under the Addendum, and shall certify such return or deletion to the Exporter. This obligation applies to all personal data in the Importer's possession or control, and (in the case of Modules 2 and 3) to any personal data held by any authorised sub-processor. The obligation to delete does not apply to the extent the Importer is required by applicable law to retain some or all of the personal data, in which case the Importer shall continue to ensure the confidentiality of such personal data and shall not actively process it further.
SIGNATURE BLOCKS
The Parties have entered into this Addendum on the date set out in Table 1.
EXPORTER
Signed for and on behalf of: [Insert entity name]
Signature: ________
Name (print): [Insert]
Title: [Insert]
Date: ________
IMPORTER
Signed for and on behalf of: [Insert entity name]
Signature: ________
Name (print): [Insert]
Title: [Insert]
Date: ________
Drafting note: Electronic signatures are acceptable in accordance with the Electronic Communications Act 2000 and the general common law position on execution, provided that (i) the Approved EU SCCs to which this Addendum is appended have been executed by the same signatories or by their duly authorised representatives, (ii) the signatories are duly authorised to bind their respective entities, and (iii) the executed counterparts are retained on the deal file. Where there are multiple Exporters or Importers, replicate the signature block above for each additional party.
ANNEXES — BLANK FILLABLE FORMS
These Annexes replicate and cross-refer to the Appendix of the Approved EU SCCs and provide the granular content underpinning Table 3 above. They are to be retained as blank fillable forms in the template and completed for each transaction. Where the Appendix to the underlying EU SCCs has already been fully populated, that Appendix may be attached to this Addendum in lieu of separate completion of these Annexes, provided that the amendments effected by Section 10 of the Mandatory Clauses are given effect.
Annex I.A — List of Parties
Data Exporter(s).
(Repeat block for each additional Exporter.)
Data Importer(s).
(Repeat block for each additional Importer.)
Annex I.B — Description of Transfer
Annex I.C — Competent Supervisory Authority
For the purposes of this UK Addendum, and pursuant to the amendments effected by Section 10 of the Mandatory Clauses, the competent supervisory authority is the Information Commissioner (the ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.
Where the same personal data is subject in parallel to a set of EU SCCs governing an EEA-originating flow, the competent EU supervisory authority for the purposes of that parallel instrument is: [Insert lead EU supervisory authority in accordance with Clause 13 of the EU SCCs — e.g., Irish Data Protection Commission; Commission Nationale de l'Informatique et des Libertés (CNIL); etc.].
Annex II — Technical and Organisational Measures
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
Drafting note: Identify each measure to a level of specificity sufficient (a) for the Importer to demonstrate compliance and (b) for a supervisory authority to assess the adequacy of the measure. Do not use generic descriptors such as "industry standard" or "reasonable measures" without further particularisation. Where supplementary measures have been identified in the TIA as necessary to bring the transfer up to an essentially equivalent level of protection, those supplementary measures must be reflected in this Annex II.
Annex III — List of Sub-processors
Applicable only to Modules 2 and 3.
The controller has authorised the use of the following sub-processors:
Drafting note: Indicate the approval mechanism selected in Table 2 (specific prior authorisation vs. general written authorisation) and the notification period applicable to changes to the list of sub-processors under Clause 9(a) of the Approved EU SCCs. The ICO expects the notification period to be sufficient to enable the controller to object to intended changes; a period of not less than 30 days is generally appropriate, but a longer period may be warranted depending on the sensitivity of the processing.
DRAFTING NOTES AND FIRM-INTERNAL GUIDANCE
Appendix — to be removed before execution.
Deployment Checklist
Before releasing this Addendum to a counterparty or presenting it to the client for execution, the engagement lawyer must confirm each of the following:
1. Transfer Impact Assessment. A TIA has been completed and is on the deal file. The TIA identifies the destination jurisdiction, considers the third-country access laws and practices in that jurisdiction, and records the parties' documented conclusion (with supplementary measures where required) that the transfer provides an essentially equivalent level of protection. TIA reference: [ ].
2. Underlying EU SCCs. The Approved EU SCCs (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) have been executed by the same parties, with the correct Module(s) selected, and with the Appendix fully populated. Reference to executed EU SCCs: [ ].
3. Identity and capacity of parties. The identity of each Exporter and each Importer has been verified, including corporate name, jurisdiction of incorporation and registration number. The processing capacity of each party (controller / processor / joint controller) has been analysed and correctly reflected in Annex I.A. Any "controller of a controller" or UK-established importer scenarios have been considered and documented.
4. Supervisory authority position. The ICO has been correctly identified as the competent supervisory authority for the UK-originating flow. Where the same transfer is also subject to the EU GDPR, the competent lead EU supervisory authority has been separately identified in Annex I.C, and any one-stop-shop / lead authority analysis has been performed.
5. Supplementary measures. Any supplementary measures identified in the TIA as necessary have been reflected in Annex II. Where the supplementary measures are contractual (e.g., transparency obligations, government-access reporting), they have been recorded in an accompanying agreement or as bespoke additions to the underlying EU SCCs (not to the Mandatory Clauses).
6. Sub-processors. Where Modules 2 or 3 apply, all sub-processors have been enumerated in Annex III, with sufficient particulars, and the approval mechanism (specific or general) and notification period have been selected in Table 2.
7. Signatory authority. Each signatory has authority to bind the entity on whose behalf they sign. Where the signatory is signing under a power of attorney or delegated authority, the underlying authority has been reviewed and a copy is on file.
8. Execution formalities. The document is executed in duplicate, or a counterparts provision is included in the underlying commercial agreement, and the executed counterparts have been circulated and stored on the deal file. The signatories match those on the underlying EU SCCs.
Related Firm Precedents
The following firm precedents may be relevant when deploying this template. Refer to each by generic reference only; do not embed matter-specific content from any precedent into this template.
• Group Data Protection Policy
• International Transfers Policy & Mechanism Selection Guidance
• Transfer Impact Assessment (TIA) precedent template
• EU SCCs precedent shell (Modules 1–4)
• UK IDTA standalone template
• Data Processing Addendum (DPA) precedent
• Sub-processor notification template
Version Control Log
Review Cycle
This template is to be reviewed annually by the firm's data protection practice group, and additionally on any of the following triggers:
• any material change to UK Data Protection Laws (including the UK GDPR and the Data Protection Act 2018);
• issuance by the ICO of a Revised Approved Addendum under section 119A(4) DPA 2018;
• material new ICO guidance on international transfers or Transfer Impact Assessments;
• material developments in the case law of the UK courts or the Court of Justice of the European Union concerning international transfers (including any successor jurisprudence to Schrems II);
• material change to the EU SCCs by the European Commission.
END OF TEMPLATE — DELETE ALL ITALICISED DRAFTING NOTES AND THIS APPENDIX BEFORE EXECUTION.
| Field | Entry |
| Template version | [ ] |
| Date of last review | [ ] |
| Reviewed by | [ ] |
| Approved by | [ ] |
| Next scheduled review | [ ] |
| Field | Entry |
| Client | [ ] |
| Matter | [ ] |
| Engagement reference | [ ] |
| Responsible partner | [ ] |
| Responsible associate | [ ] |
| Field | Entry |
| Full legal name | [Insert] |
| Entity type and jurisdiction of incorporation | [Insert] |
| Registered office address | [Insert] |
| Company / registration number | [Insert] |
| ICO registration number (if applicable) | [Insert] |
| Authorised signatory — name | [Insert] |
| Authorised signatory — title | [Insert] |
| Data protection contact — name | [Insert] |
| Data protection contact — title | [Insert] |
| Data protection contact — email | [Insert] |
| Field | Entry |
| Full legal name | [Insert] |
| Entity type and jurisdiction of incorporation | [Insert] |
| Principal office address | [Insert] |
| Registered agent (if US or offshore entity) | [Insert] |
| Authorised signatory — name | [Insert] |
| Authorised signatory — title | [Insert] |
| Data protection contact — name | [Insert] |
| Data protection contact — title | [Insert] |
| Data protection contact — email | [Insert] |
| Exporter (who sends the Restricted Transfer) | Importer (who receives the Restricted Transfer) |
| Parties' details | Full legal name: [Insert] |
Trading name (if different): [Insert]
Main address (if a company registered address): [Insert]
Official registration number (if any) (company number or similar identifier): [Insert]
Trading name (if different): [Insert]
Main address (if a company registered address): [Insert]
Official registration number (if any) (company number or similar identifier): [Insert]
Key Contact
Job title: [Insert]
Contact details including email: [Insert]
Job title: [Insert]
Contact details including email: [Insert]
Signature (if required for the purposes of Section 2)