ICO transfer checklist: IDTA, Addendum or BCRs, plus a transfer risk assessment (Information Commissioner's Office, 'A brief guide to international transfers', checklist 'Making a restricted transfer')
A UK holder sending personal data to a US buyer that is not on the UK Extension list picks the IDTA or the Addendum to the EU clauses and completes a written transfer risk assessment. The IDTA is the stand-alone UK contract, the Addendum rides on the EU clauses.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“We choose our safeguard, for example: the International data transfer agreement (IDTA); the International data transfer addendum (the Addendum); or UK binding corporate rules (BCRs). We complete a transfer risk assessment (TRA) to make sure that the standard of protection for people's information is not materially lower after we transfer it.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide