Guide updated: the DPA guide now covers the UK addendum in detail

The UK retained the substance of the GDPR after leaving the EU, so the Article 28 terms in a DPA are the same for a UK customer. What differs is the transfer mechanism. The EU Standard Contractual Clauses do not on their own cover transfers from the UK; a UK customer needs either the UK’s International Data Transfer Agreement or, more commonly in practice, the UK Addendum layered onto the EU SCCs.

What changed in the guide

A new section walks through which document to use when a vendor has both EU and UK customers (usually the SCCs plus the Addendum, so one DPA covers both), how the UK’s transfer risk assessment differs from the EU’s, and the handful of drafting points where UK and EU customers push differently — breach notification timing being the usual one.

Why it matters

A US vendor that signs an EU-form DPA with a UK customer has technically not put a valid transfer mechanism in place. Nobody will notice until an audit or an incident, which is precisely when it becomes expensive.

The section was written with input from counsel qualified in England and Wales, through Icon Partners’ network — the UK is not a US attorney’s jurisdiction, and the guide says so.