In the context of UK data transfers, the Standard Contractual Clauses (SCCs), have been replaced or supplemented by the International Data Transfer Agreement (IDTA) and the International Data Transfer Addendum (UK Addendum). See here for up-to-date document templates.

These are legally approved, pre-written contract terms used by Atom to ensure that when personal data is transferred from the UK to a country that does not have a UK “adequacy decision” (meaning it is not deemed to provide an adequate level of data protection), the data remains protected to the standard required by UK data protection law (the UK GDPR and Data Protection Act 2018).

Here is a breakdown of the key clauses/mechanisms currently in use for UK international data transfers:

1. International Data Transfer Agreement (IDTA)

• What it is: A standalone contract issued by the UK’s Information Commissioner’s Office (ICO).
• Purpose: It is used as an appropriate safeguard for transferring personal data out of the UK to a third country that lacks a UK adequacy decision.
• Key Features: It imposes specific, binding contractual obligations on both the data exporter (the UK organisation sending the data) and the data importer (the foreign organisation receiving the data) to protect the personal information. This includes obligations relating to data security, data subjects’ rights, and accountability to the ICO.

2. International Data Transfer Addendum (UK Addendum)

• What it is: A short add-on document that is used alongside the European Commission’s new Standard Contractual Clauses (EU SCCs).
• Purpose: It modifies the EU SCCs to make them compliant with UK data protection law. This is often used by multinational businesses that transfer data from both the EU and the UK, as it allows them to use a single, unified contract set (the EU SCCs + the UK Addendum) for both jurisdictions.

3. Core Purpose of the Clauses

The goal of both the IDTA and the UK Addendum is to provide:

• Appropriate Safeguards: They contractually require the foreign data importer to apply UK-level data protection standards.
• Enforceable Rights: They ensure that the individuals whose data is being transferred maintain their rights under the UK GDPR and have a mechanism for redress (e.g., through legal claims or complaints to the ICO).

In essence, if the country is not adequate, the clauses act as a contractual bridge to provide the necessary protection. Atom can choose to select IDTA or the UK Addendum (with the EU SCCs) as the “appropriate measure” per section 9.7(b) of our Privacy Policy.

This policy outlines our commitment to retaining and deleting data in compliance with legal and business requirements.

1. Scope and Purpose

This policy applies to all data, whether physical or electronic, held by Atom Freelance Ltd (the “Company”). Its purpose is to ensure that data is only retained for as long as it is necessary for the purposes for which it was collected, or as required by law.

2. Retention Principles

We adhere to the following key principles regarding data retention:

• Necessity: Data will be kept for no longer than is necessary to fulfil the purpose for which it was collected.
• Legal Compliance: We will retain data to meet our legal, accounting, and regulatory obligations.
• Security: Data scheduled for destruction will be securely disposed of to prevent unauthorized access.

3. Retention Schedule

The following table provides general retention periods for common categories of data. These periods are minimum requirements and may be extended if required for specific legal or operational reasons.

Download the Atom Freelance Ltd Policies and Staff Handbook PDF here.