Relationship to the EU DPA
The EU GDPR DPA applies in its entirety to UK personal data with the following substitutions:
| EU term | UK equivalent |
|---|---|
| ”GDPR" | "UK GDPR” + “Data Protection Act 2018" |
| "Union or Member State law" | "UK law" |
| "Supervisory Authority" | "Information Commissioner’s Office (ICO)" |
| "EEA" | "United Kingdom" |
| "EU Standard Contractual Clauses" | "UK International Data Transfer Agreement (IDTA)” or “EU SCCs + UK Addendum” |
Cross-border transfers from the UK
A UK workspace is hosted in Processor’s EU cell, on AWS in Frankfurt (eu-central-1), where its application servers, database, file storage and backups stay.
Where personal data transfers outside the UK to a country without an adequacy decision, Processor relies on the UK IDTA (or EU SCCs with the UK Addendum) embedded in upstream vendor DPAs.
UK-specific rights
Data Subjects may exercise their rights under Part 3 of the DPA 2018 in addition to UK GDPR rights. Processor assists Controller with responses per §6(e) of the EU template.
Supervisory authority
The ICO is the designated Supervisory Authority. Personal-data breaches requiring notification are reported to the ICO within 72 hours.
Governing law
This DPA follows the EU DPA: it is governed by the laws of the State of Delaware. The UK IDTA and the UK Addendum to the EU SCCs, where they apply, are governed by the laws of England and Wales as they themselves require, and disputes arising from them are resolved by the courts of England and Wales.
Signatures as per the EU DPA template. Contact legal@lydira.com to request the executable document.