UK and Swiss transfers: the IDTA, the UK Addendum and the Swiss list

How does the UK control transfers?

The UK GDPR allows a restricted transfer under UK adequacy regulations, under appropriate safeguards, or under an exception. The Data (Use and Access) Act 2025 changed the test: the level of protection in the destination must be not materially lower than in the UK (the "data protection test"). Section 85 of and Schedule 7 to the Act, which make this change, came into force on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82). The ICO publishes guidance on international transfers, including how to complete a transfer risk assessment.

Sources: Data (Use and Access) Act 2025, section 85 and Schedule 7; SI 2026/82, legislation.gov.uk; ICO, international transfers.

What are the IDTA and the UK Addendum?

Both are UK standard data protection clauses, of the kind provided for in section 119A of the Data Protection Act 2018.

• The IDTA is a stand-alone UK agreement for restricted transfers.
• The UK Addendum is added to the EU standard contractual clauses, so that one set of clauses covers EU and UK transfers together. For groups that already use the EU clauses, it is usually the simpler choice.

The ICO's guidance says that if you plan to use one of the Article 46 safeguards, which include the IDTA and the Addendum, you must first complete a transfer risk assessment (now called the "data protection test" in the legislation).

Sources: Data Protection Act 2018, section 119A; ICO, appropriate safeguards; ICO, completing a transfer risk assessment.

What is the UK Extension for US companies?

The Data Protection (Adequacy) (United States of America) Regulations 2023 came into force on 12 October 2023. They cover transfers from the UK to US organisations that participate in the UK Extension to the EU-US Data Privacy Framework. Check on the official list that the recipient has joined the UK Extension, not only the EU Framework.

Sources: SI 2023/1028, legislation.gov.uk; Data Privacy Framework list.

What about transfers from the EU to the UK?

The European Commission renewed its adequacy decisions for the United Kingdom in December 2025, under the GDPR and under the Law Enforcement Directive. Personal data can therefore flow from the EU to the UK without extra safeguards.

Source: European Commission, adequacy decisions.

How does Switzerland control transfers?

Under the Federal Act on Data Protection of 25 September 2020 (FADP), personal data may be disclosed abroad if the Federal Council has decided that the destination guarantees an adequate level of protection. Annex 1 to the Data Protection Ordinance lists those countries; all EU and EEA countries are on it. Otherwise, appropriate safeguards are needed, such as standard data protection clauses (Article 16(2)(d) FADP).

• United States. From 15 September 2024, the list includes the United States for personal data processed by companies certified under the Swiss-US Data Privacy Framework.
• The EU clauses. The Federal Data Protection and Information Commissioner (FDPIC) accepts the EU standard contractual clauses for transfers from Switzerland, adapted to Swiss law: among other points, the FDPIC as supervisory authority, the law governing contractual claims, and references to the GDPR read as references to the FADP.

Source: FDPIC, transfer of personal data on the basis of standard data protection clauses.

The three regimes side by side

Checklist

• For each transfer, identify which regime applies (EU, UK, Swiss, or several)
• For US recipients, check the official list for the EU Framework, the UK Extension and the Swiss Framework separately
• UK: IDTA or UK Addendum in every contract that relies on safeguards
• Switzerland: EU clauses with the Swiss adaptations, or a listed country
• Risk assessments documented for each contract-based transfer
• Review dates set, including after any ruling on the EU-US Framework

Questions people ask

Can one contract cover EU, UK and Swiss transfers? Yes. Many groups use the EU clauses, with the UK Addendum and the Swiss adaptations attached.

Is a US company in the EU Framework automatically covered for UK data? No. It must also have joined the UK Extension. Switzerland has its own framework and certification.

Did the 2025 UK Act make transfers easier? It changed the test to "not materially lower" protection. How far that changes outcomes in practice will depend on the government's decisions and the ICO's guidance.

Does the EU still treat the UK as adequate? Yes, under the decisions renewed in December 2025.

Update log

• 16 October 2026: first published; sources checked and citations added the same day.