Intra Group Data Transfer Agreement Template for England and Wales

An Intra Group Data Transfer Agreement is a specialized legal contract that governs how corporate groups transfer personal data between their entities while maintaining compliance with UK data protection laws. Under England and Wales jurisdiction, this agreement ensures your organization meets the stringent requirements of UK GDPR and the Data Protection Act 2018 when sharing personal data across group companies, subsidiaries, and regional offices.

When do you need this document?

You need an Intra Group Data Transfer Agreement when your corporate group regularly shares personal data between different legal entities within your organization. This becomes essential when your parent company needs to transfer employee records to subsidiaries, when regional headquarters process customer data on behalf of local entities, or when you consolidate data processing activities across multiple group companies. The agreement is particularly crucial if your group operates across different jurisdictions, as it provides a consistent framework for data protection compliance. You'll also need this agreement when conducting due diligence activities, implementing group-wide systems, or centralizing HR, finance, or customer service functions that involve personal data processing.

Key legal considerations

The agreement must establish clear legal bases for data transfers under UK GDPR, whether through legitimate interests, contractual necessity, or consent. You need to define the roles and responsibilities of each group entity, specifying which entities act as data controllers versus data processors for different types of personal data. Security measures and technical safeguards must be detailed to protect data during transfer and storage. The agreement should address data subject rights, including how individuals can exercise their rights to access, rectify, or delete their personal data across the group. Include provisions for data breach notification procedures, ensuring compliance with the 72-hour reporting requirement under UK GDPR. Consider implementing Standard Contractual Clauses if your group includes entities outside the UK, particularly when transferring data to countries without adequacy decisions.

Legal requirements in England and Wales

Under England and Wales law, your Intra Group Data Transfer Agreement must comply with UK GDPR principles, ensuring data is processed lawfully, fairly, and transparently. The Data Protection Act 2018 requires specific safeguards for sensitive personal data categories, including health records and criminal conviction data. You must conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities within the group. The agreement must designate a Data Protection Officer if required under UK GDPR thresholds. Include provisions for supervisory authority cooperation, as the Information Commissioner's Office (ICO) has jurisdiction over UK-based processing activities. Ensure the agreement addresses international transfer mechanisms, particularly post-Brexit requirements for transfers to EU entities, which may require adequacy decisions or appropriate safeguards under Standard Contractual Clauses or Binding Corporate Rules.