# UK International Data Transfer Addendum (IDTA Addendum) to the EU SCCs **For transfers of personal data from the United Kingdom to a third country that does not have a UK adequacy regulation.** This document is Corvalon's customisation of the UK Information Commissioner's Office (ICO) **International Data Transfer Addendum to the EU Commission Standard Contractual Clauses** (Version A1.0, in force 21 March 2022). The IDTA Addendum is the ICO's chosen mechanism for re-using the EU 2021 SCCs as a transfer tool under UK GDPR Article 46(2)(b). The ICO has issued two parallel UK transfer tools: 1. **The IDTA** — a standalone UK contract (the IDTA proper), available at the ICO website. 2. **The IDTA Addendum** — modifies the EU 2021 SCCs so they work as a UK transfer tool. Corvalon's **default UK transfer mechanism is the IDTA Addendum** because it lets Corvalon execute a single SCC document (with this addendum) covering both EEA-controller and UK-controller customer data, rather than maintaining two parallel transfer contracts. Customers who require the standalone IDTA may request it; Corvalon Legal will negotiate that variant separately. This document is **not legal advice.** It is a template Corvalon makes available to streamline the Customer's own UK GDPR review. --- ## How to use this template 1. **First execute** the Standard Contractual Clauses (`Standard_Contractual_Clauses.md`) with all Annexes I, II, III completed. 2. **Then execute** this IDTA Addendum as a separate exhibit. It cross-references and modifies the SCCs. 3. **Pair with the Transfer Impact Assessment** (`Transfer_Impact_Assessment.md`) — the TIA already covers the UK as a transferring jurisdiction. 4. **Re-assess every 24 months** OR upon changes per Section 3 below. --- ## Section 1 — Incorporation of the IDTA Addendum The Parties incorporate the ICO **International Data Transfer Addendum to the EU Commission Standard Contractual Clauses** (Version A1.0, dated 21 March 2022) into the Data Processing Agreement and the executed SCCs. The full text of the IDTA Addendum is available at: > https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-data-transfer-agreement-and-guidance/ By signing this document, the Parties: 1. Adopt the IDTA Addendum's mandatory clauses verbatim. 2. Complete Tables 1, 2, 3, and 4 of the IDTA Addendum as set out in Sections 2 and 4 below. 3. Acknowledge that the IDTA Addendum **modifies the 2021 SCCs** for the purposes of UK GDPR Article 46(2)(b), and that the SCCs as so modified apply to transfers of personal data subject to UK GDPR. --- ## Section 2 — Table 1: Parties | Field | Exporter | Importer | |---|---|---| | Start date of the Addendum | `[Effective date — usually the date of SCC execution]` | `[Same]` | | Legal name | `[Customer Legal Name]` | Corvalon, Inc. | | Trading name (if different) | `[Customer Trading Name or "N/A"]` | Corvalon HRM | | Main address | `[Customer Registered UK Address]` | `[Corvalon Registered Address — to be confirmed post-LLC migration]` | | Official registration number (Companies House, etc.) | `[Customer Companies House Number]` | `[Corvalon Registration Number — to be confirmed]` | | Key Contact: Full Name (or job title) | `[Customer DPO or Privacy Lead Name / Title]` | `[Corvalon Privacy Officer Name]` | | Key Contact: Job title | `[Customer DPO Title]` | Privacy Officer | | Key Contact: Contact details | `[Customer DPO Email + Phone]` | privacy@corvalonhrm.com | | Signature (if required for the start date of the Addendum) | `[Signature]` | `[Signature]` | --- ## Section 3 — Table 2: Selected SCCs, Modules and Selected Clauses | Field | Selection | |---|---| | Which version of the Approved EU SCCs are being used? | **Module Two — Controller to Processor**, as set out in `Standard_Contractual_Clauses.md`. | | Reference (if any) | The 2021 SCCs executed between the Parties on `[date]`. | | Other identifier (if any) | Corvalon Data Processing Agreement effective `[date]`. | | Are the Approved EU SCCs the version published on the date below? | **Yes** — Commission Implementing Decision (EU) 2021/914 of 4 June 2021. | | Are there any modifications? | The 2021 SCCs are incorporated unmodified. The Election Table in `Standard_Contractual_Clauses.md` Part A records the parties' choices under Clauses 7, 9(a), 11, 17, and 18 of the SCCs. | --- ## Section 4 — Table 3: Appendix Information The IDTA Addendum requires the parties to complete an Appendix. Corvalon's positions are: ### 4.1 Annex 1A — List of Parties Same as the SCCs Annex I.A (`Standard_Contractual_Clauses.md` Part B). ### 4.2 Annex 1B — Description of Transfer Same as the SCCs Annex I.B, with the following UK-specific clarifications: - **Data subjects** include UK-resident employees, applicants, contractors, dependents, beneficiaries, and emergency contacts. - **Frequency of transfer** is continuous (on-demand) for the duration of the MSA. - **Period for which the personal data will be retained** mirrors DPA §5; for UK-specific retention requirements (e.g., HMRC PAYE records), the longer of the DPA-default and the statutory UK minimum applies. - **For transfers to sub-processors** in countries outside the UK, the same sub-processor list (`Sub_Processor_List.md`) and onward-transfer mechanism (SCC Clause 8.7) apply. ### 4.3 Annex II — Technical and Organisational Measures Same as the SCCs Annex II (`Standard_Contractual_Clauses.md` Part B Annex II). All TOMs apply equally to UK-source personal data. ### 4.4 Annex III — List of Sub-processors Same as the SCCs Annex III, which incorporates `Sub_Processor_List.md` by reference. --- ## Section 5 — Table 4: Ending this Addendum when the Approved Addendum Changes Either party may terminate this IDTA Addendum if the ICO publishes a revised IDTA Addendum (the "Approved Addendum") that would adversely change the rights or obligations of either party. Termination right exercised by: **Both the Exporter and the Importer.** This selection mirrors the most protective option in IDTA Addendum Table 4 and ensures either party can re-paper the transfer if the ICO materially revises the Addendum. --- ## Section 6 — UK-Specific Supplementary Considerations In addition to the supplementary measures set out in the Transfer Impact Assessment (`Transfer_Impact_Assessment.md`), the following UK-specific factors apply: ### 6.1 UK Data Protection Act 2018 — Special Categories Where the Customer transfers special category data within the meaning of UK GDPR Article 9 (e.g., health-related data for FMLA-equivalent UK leave administration, or trade union membership for collective bargaining), the additional safeguards in Schedule 1 of the Data Protection Act 2018 apply. Customer is responsible for identifying the relevant Schedule 1 condition for each special-category processing activity. ### 6.2 Investigatory Powers Act 2016 The Customer acknowledges that the UK is the source country for this transfer (not the destination), and therefore UK IPA 2016 surveillance authorities are not relevant to the destination-country assessment in the TIA. However, the Customer should consider IPA 2016 implications for any onward processing performed in the UK by the Customer itself (e.g., bulk personal datasets, communications data) — this is outside Corvalon's scope as Processor. ### 6.3 ICO Guidance The Parties acknowledge the ICO's guidance on international transfers, including the **Transfer Risk Assessment Tool** (TRA) published by the ICO. The TIA in `Transfer_Impact_Assessment.md` is structured to satisfy the EDPB Recommendations 01/2020 framework; Customer may additionally complete the ICO TRA for UK-regulator-facing documentation. ICO TRA tool: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-data-transfer-agreement-and-guidance/ ### 6.4 Re-evaluation Triggers (UK-Specific) In addition to the re-evaluation triggers in the TIA, this IDTA Addendum is re-assessed if: - The ICO publishes a revised IDTA Addendum (the "Approved Addendum") — see Section 5. - The UK Government revokes or modifies the UK GDPR / Data Protection Act 2018 in a way that changes UK adequacy posture. - The UK Government issues new adequacy regulations covering the destination country (in which case the IDTA Addendum may become unnecessary). --- ## Section 7 — Execution By signing below, the Parties agree to be bound by the IDTA Addendum as completed in Sections 2-5 above, and acknowledge that this document modifies the 2021 SCCs executed between them for the purposes of UK GDPR Article 46(2)(b). **Customer signatory (Exporter):** - Name: `[Customer Signatory Name]` - Title: `[Title]` - Signature: `[Signature]` - Date: `[Date]` **Corvalon signatory (Importer):** - Name: `[Corvalon Signatory Name]` - Title: `[Title]` - Signature: `[Signature]` - Date: `[Date]` --- ## References - ICO International Data Transfer Addendum (Version A1.0) — https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf - ICO Guidance on International Transfers — https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-data-transfer-agreement-and-guidance/ - ICO Transfer Risk Assessment Tool — https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-data-transfer-agreement-and-guidance/international-data-transfer-agreement-and-guidance/the-international-data-transfer-agreement-and-the-eu-sccs-with-uk-addendum/ - Standard Contractual Clauses template: `Standard_Contractual_Clauses.md` - Transfer Impact Assessment template: `Transfer_Impact_Assessment.md` - DPA Template: `DPA_Template.md` - Sub-Processor List: `Sub_Processor_List.md` --- **Document status:** Template. Requires Customer-specific customisation in Tables 1-4 before execution. Engage Customer UK legal counsel before signing — this template does not substitute for independent legal review. **Last revised:** 2026-05-20 (D-540).