UK / United Kingdom / revised 28 Oct 2026
UK GDPR Transfers for AI: IDTA, Addendum and Data Bridge
The UK kept the GDPR's transfer architecture after Brexit but now runs its own adequacy decisions, contract templates and, since the Data (Use and Access) Act 2025, its own test for whether protection abroad is good enough. For AI teams the practical tools are UK adequacy regulations (including the EEA), the UK-US data bridge for certified US companies, and the IDTA or the UK Addendum for everything else.
- Citation
- UK GDPR Articles 44 to 49; Data Protection Act 2018, section 119A; International Data Transfer Agreement and International Data Transfer Addendum to the EU SCCs
- Regulator
- Information Commissioner's Office (ICO)
- In force
- 21 March 2022 (IDTA and UK Addendum)
- Maximum penalty
- GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher
Restricted transfers under the UK GDPR
A restricted transfer occurs when personal data subject to the UK GDPR is sent to a receiver outside the UK that is a separate legal person. It needs UK adequacy regulations, an appropriate safeguard such as the IDTA, the UK Addendum or binding corporate rules, or an exception under Article 49. UK adequacy regulations cover the EEA, so routing UK prompts to Dublin or Frankfurt needs no additional contract for transfer purposes.
The IDTA and the UK Addendum
The ICO issued two documents under section 119A of the DPA 2018, in force from 21 March 2022: the stand-alone International Data Transfer Agreement, and the International Data Transfer Addendum, which adapts the EU's 2021 SCCs for UK transfers so one contract can cover both regimes. Contracts on the old EU SCCs had to be replaced by 21 March 2024.
The UK-US data bridge
From 12 October 2023, UK adequacy regulations cover transfers to US organisations that have joined the UK Extension to the EU-US Data Privacy Framework. Exporters must check that the specific importer participates in the UK Extension, and must identify special category data as sensitive when sending it.
The data protection test
The Data (Use and Access) Act 2025 replaced the transfer provisions with a data protection test, commenced on 5 February 2026: protection in the destination must not be materially lower than in the UK. Exporters relying on safeguards must reasonably and proportionately consider that the test is met. Transfer arrangements made before commencement can generally continue if they remain compliant.
- 01
A UK data plane distinct from the EU
UK tenants should resolve to UK-region capacity first, with EEA endpoints as a lawful fallback under UK adequacy regulations. - 02
UK Extension status per US importer
EU DPF certification is not enough for UK data. Record whether each US importer participates in the UK Extension. - 03
Contract reference on the route
Routes to non-adequate countries carry the IDTA or Addendum reference and the date of the transfer assessment under the data protection test. - 04
NHS numbers and health terms
Detect UK NHS numbers and health terms so special category data can be flagged to UK-US data bridge importers or kept in the UK.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | When X-YTT-Policy is uk-gdpr-idta, permit UK and EEA endpoints without further checks. | UK adequacy regulations cover the EEA, so these are not restricted transfers requiring a safeguard. |
| 02 | Permit US endpoints only where the importer participates in the UK Extension to the DPF. | The UK-US data bridge of 12 October 2023 covers certified participants only. |
| 03 | For other third countries, require an IDTA or UK Addendum reference and a recorded data protection test assessment. | UK GDPR Article 46 safeguards remain the basis, assessed against the not materially lower standard. |
| 04 | Keep requests containing NHS numbers in UK capacity for tenants flagged as NHS suppliers. | Health data is special category, and NHS contracts commonly restrict processing location. |
uk-gdpr-idta
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.uk_gdpr_idta
import rego.v1
uk_adequate(country) if country == "GB"
uk_adequate(country) if data.uk.adequacy_regulations[country]
uk_bridge if {
input.endpoint.country == "US"
input.endpoint.importer.dpf_uk_extension == "active"
}
uk_safeguard if {
input.endpoint.transfer_tool in {"uk-idta", "uk-addendum"}
input.endpoint.dp_test_assessed_at
}
default allow := false
allow if uk_adequate(input.endpoint.country)
allow if uk_bridge
allow if uk_safeguard
deny contains "no UK transfer basis" if not allowEach item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Can one contract cover EU and UK transfers?
Yes. The UK Addendum attaches to the EU's 2021 SCCs, so a single SCC agreement with the Addendum covers both. The IDTA is the alternative for UK-only arrangements.
Do I need a new transfer risk assessment after the DUA Act?
Transfers set up before 5 February 2026 can generally continue if they remain compliant. New or materially changed transfers should be assessed against the not materially lower standard.
What is the maximum UK fine?
The higher maximum is GBP 17.5 million or 4% of worldwide annual turnover, whichever is greater.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.