This UK IDTA applies to transfers of personal data from the UK to countries without UK adequacy decisions.
Table 1: Parties
Exporter: [Customer per Agreement]
Importer: Wellness Research Institute LLC (Shortlister), Illinois, USA
Table 2: Transfer Details
Exporter status: Controller
Importer status: Processor
Governing law: Laws of England and Wales
Legal claims: Courts of England and Wales
Table 3: Transferred Data
Data subjects: Same as EU SCCs Annex I.B
Personal data: Same as EU SCCs Annex I.B
No special categories intentionally processed
Table 4: Security
Appropriate technical and organizational measures as described in:
– Data Processing Agreement
– www.myshortlister.com/security
Table 5: Sub-Processors
Listed at: www.myshortlister.com/subprocessors
30-day notice for changes
The UK-approved mandatory clauses for transfers are incorporated by reference from the ICO template.
Key obligations:
– Process only on instructions
– Ensure security of processing
– Assist with data subject rights
– Allow audits as reasonably required
– Delete/return data on termination
– Comply with UK GDPR requirements
– Each party bears own compliance costs
– Liability as per main Agreement
– Disputes resolved per main Agreement
Where Customer is subject to both EU and UK requirements:
– EU SCCs apply with UK-specific modifications
– References to “EU” read as “UK”
– References to “GDPR” read as “UK GDPR”
– Supervisory authority is the ICO
By execution of the Agreement, parties agree to these terms for UK transfers.