How to Review a UK IDTA Versus a UK Addendum in a Vendor DPA

Eden, Ops at a 37-person UK B2B SaaS, is about to treat “EU SCCs / DPF covers UK” as the transfer tool. Knowing how to review uk idta versus uk addendum in a vendor dpa is a 25-minute hunt: run the ICO three-step test, check adequacy or UK Extension for this recipient and this data type, then complete, swap, or walk. Blank Table 2 is not a safeguard.

September 2026. Eden is the controller, not the processor. English-law packet — the exact file set that will be signed — is the DPA (data processing agreement) plus the exhibit — an attached schedule — Exhibit C plus Schedule 4. Exhibit C names EU SCCs Module 2 dated 4 June 2021. Table 2 is blank. Table 3 says “see Trust Centre.” Table 4 is empty. AE Slack: “EU SCCs cover UK data — don’t block Friday.” The deck screenshot is the EU-US DPF list. No TRA. Yesterday’s fallback IDTA has an empty Linked Agreement row.

EU SCCs are not valid on their own for a UK restricted transfer — and empty Addendum tables are not a safeguard either. ICO (21 September 2026): two tools — the IDTA or the Addendum to the Commission SCCs of 4 June 2021. Always complete Part 1 tables. Harper James (2 September 2026): EEA currently has full UK adequacy — if you rely on it, skip IDTA/Addendum for an EEA recipient.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

How do you test restricted transfer, adequacy, or DPF?

A UK transfer tool is only required if this is a restricted transfer and covering adequacy does not apply. Run the ICO three-step test: UK GDPR applies; you initiate a send or remote access outside the UK; the receiver is a separate legal entity. Yes to all three means a restricted transfer.

Do: log the three answers plus adequacy scope for this recipient and this data type. Don’t: treat “we’re DPF certified” as the UK Extension. ICO restricted-transfer test. ICO UK Extension (30 July 2026): US is partial — active DPF list and UK Extension self-certification covering this data type. For example, Eden’s EU-US screenshot is the wrong list. If covering adequacy applies, skip the tool (no TRA). If not, use an Article 46 tool or a valid Article 49 exception.

Standalone IDTA or EU SCCs plus a UK Addendum — which paper matches this deal?

The ICO gives two tools: a standalone International Data Transfer Agreement, or the UK Addendum bolted onto the Commission SCCs of 4 June 2021. EU SCCs alone fail UK GDPR. Pick UK-only versus UK plus EEA. Eden’s Exhibit C claims Module 2 — an Addendum path, not an IDTA path.

Do: match the tool to the regimes. Don’t: treat IDTA and Addendum as the same PDF. DPO Consulting (21 Nov 2025): IDTA has no modules and cannot meet EU GDPR transfer rules. Mixed UK and EU flows usually take SCCs plus the UK Addendum. In practice, a UK-only controller-to-US-processor can use the IDTA if tables are filled and a Linked Article 28 DPA exists.

How do you check Part 1 tables, modules, and mandatory clauses?

An attached Addendum with empty Part 1 tables is not a safeguard. ICO: always complete Part 1. Missing Part 1, or over-edited mandatory clauses, means it is no longer a safeguard. Circle Eden’s blank Table 2. High flag — pause-the-signature severity; a named human still opens.

Do: reject blank Table 2, Trust-Centre-only Table 3, empty Table 4, and a non-ICO incorporation sentence. Don’t: rewrite mandatory clauses “to make them commercial.” Alternative Part 2 uses Addendum B.1.0, laid 2 February 2022. ICO news (15 January 2026) restated the three-step test. Keep using A.1.0 / B.1.0 until the ICO issues 2026 updates.

Is there a Linked Article 28 DPA — or is the IDTA pretending to be the processor contract?

The IDTA is not a processor contract by itself. If the importer is a processor, there must be an enforceable Linked Agreement that complies with Article 28 UK GDPR on or before the Start Date. Circle Eden’s fallback IDTA: the Linked Agreement row is empty.

Do: require a named, dated, attached Article 28 contract, or swap to SCCs plus Addendum with Module 2 selected. Don’t: treat the IDTA as the DPA. IDTA clause 1.4 (A.1.0) requires that Linked Agreement throughout the Term. Travers Smith: the IDTA does not deal with Article 28. If the fight is roles, annex, sub-processors, breach hours, audits, or deletion, that is a different hunt: data processing agreement checklist.

Is this the whole DPA tour or a residency pin?

This hunt is the Chapter V tool: which UK transfer paper is attached, and whether it is filled in. A completed IDTA or Addendum does not finish Article 28 and does not pin disks. Stay on the tool.

Do: one sentence each, then return. Don’t: clone those checklists. Escalate to counsel — a qualified lawyer, not the chatbot — on blank tables. If the fight is named region, backups, DR, or support access, that is a different hunt: data residency named-region review. A transfer tool is not a named-region pin. ICO completing a TRA (15 January 2026): required on a safeguard; not on covering adequacy or an exception. Extra measures belong in IDTA Part 2 — not Slack later.

When to complete, swap the tool, or walk

Complete only if the one-page log holds. Success bar: three-step test done; adequacy or UK Extension covers this recipient and this data type or is not relied on; the tool matches the regimes; Part 1 tables filled. “We have EU SCCs / DPF” is not the Friday pause sentence if Table 2 is blank.

Also log: mandatory text intact; Linked Article 28 DPA attached if the importer is a processor; TRA on file if using a safeguard. Swap = fill Table 2, lock Table 3, or attach the Art. 28 DPA. Walk if blank tables remain. Workflow: restricted transfer / adequacy / DPF → IDTA vs EU SCCs + UK Addendum → tables + modules + unedited mandatory clauses → Linked Article 28 DPA → not B06 / not B49 → complete / swap / walk. Optional: upload the same PDF to document analysis for a first-pass (first machine pass extracting clauses). A human still opens Schedule 4.