While the EU GDPR has been in operation for several years now (since 25 May 2018), we regularly assist clients who are not aware that the UK GDPR or EU GDPR may apply to them. However, the territorial scope of the UK GDPR and the EU GDPR is very broad, meaning that, even if you do not have an office in the UK or EU, the UK GDPR or EU GDPR may still apply you.

If the UK GDPR or EU GDPR does directly apply to you, there are many obligations which you need to be aware of, and comply with, and this includes the rules relating to overseas transfers. As such, it is important that you have conducted a threshold assessment to determine whether the UK GDPR or EU GDPR applies to you, or risk being in breach of the applicable privacy laws.

Given the rapidly evolving privacy landscape in Australia, you should already be conducting a data mapping exercise to understand what personal data your organisation holds and how it is collected, used, disclosed and stored. However, in order to ensure that you are complying with applicable privacy laws, this data mapping exercise should include an assessment of your international data transfers, including whether any personal data is being transferred outside of the UK or EU (such as, to Australia or other countries).

It is one thing to ensure that you have properly implemented the UK Transfer Documents into the necessary contracts. However, it is another to ensure that your organisation is actually able to comply with the obligations set out in the UK Transfer Documents, and operationalise such obligations into your organisation. As such, depending on whether you are the party transferring the personal data outside of the UK (data exporter) or the party receiving the personal data outside of the UK (data importer) (or both, depending on the contract), you should ensure that your organisation is able to comply, from an operational perspective, with the obligations which apply to it under the UK Transfer Documents.

As we mentioned above, from 22 September 2022, organisations were required to use the UK Transfer Documents (instead of the old EU SCCs) into any new contractual arrangements which involve the transfer of personal data subject to the UK GDPR. As such, your organisation must ensure that any templates, systems and processes are updated accordingly so that your employees do not continue to incorporate the old EU SCCs into new contracts.

You should review your existing contracts in order to identify all of those contracts that currently incorporate the old EU SCCs (and, therefore, will need to be updated to reflect the UK Transfer Documents).

NOTE: the old EU SCCs are also no longer valid for international transfers of personal data subject to the EU GDPR. As such, the old EU SCCs should no longer be used in any circumstances from 21 March 2024.

While it may make sense for the parties to enter into an entirely new contract (for example, if the existing contract is due to expire soon or it is no longer fit for purpose), it may not make sense to do this and you may want the existing contract to continue. If this is the case, you should develop a template variation agreement which you can use to replace the old EU SCCs with the UK Transfer Documents in your existing contracts.

Now that you have identified which contracts need to be updated (and you have a template variation agreement you can use, if relevant), you should contact the relevant contracting parties and alert them to the upcoming deadline so that the parties can amend their existing contract to replace with old EU SCCs with the UK Transfer Documents.

You should ensure that you commence this process with plenty of time to spare in advance of the deadline (noting that contracting parties may be slow to engage with you, or it may take some time to negotiate and agree the new contract or variation agreement).

Before executing your contract incorporating the UK Transfer Documents, data exporters must be satisfied that the relevant data subjects continue to have a level of protection essentially equivalent to that under the UK GDPR. This means conducting a data transfer impact assessment (DTIA), to identify the risks associated with the transfer and whether additional safeguards are required to be put in place before the transfer is made.

If you are the data importer, you may need to assist the data exporter in conducting this DTIA (such as answering questions about the number of requests you have received from public authorities for access to personal data).

Now that you have agreed the form of the variation agreement, or new contract, which incorporates the UK Transfer Documents and determined that you are able to conduct the transfer in accordance with the DTIA, you should ensure that the parties execute it before the deadline, and your organisation complies with the obligations applicable to it.