The IDTA pack, ready to sign

TRANSFER RISK ASSESSMENT UK → Peru · Saltwork Prepared by: [YOUR FULL LEGAL NAME], trading as Saltwork Date: [DATE] Review due: [DATE + 12 MONTHS], or sooner if the transfer changes 1. WHAT IS BEING TRANSFERRED, AND WHY 1.1 Saltwork builds and maintains websites and custom software for business clients in the United Kingdom. Development work is carried out with a developer based in Lima, Peru, engaged under written contract. 1.2 In the course of that work the developer may access personal data held by or on behalf of Saltwork's clients. 1.3 For each client engagement: - the client is the controller - Saltwork is the processor - the developer in Peru is a sub-processor 1.4 Clients authorise the use of sub-processors in the services agreement, and are told that a developer based in Peru is one of them. 2. THE DATA ITSELF 2.1 Categories of personal data: - business contact details of client staff (name, work email, work phone, job title) - contact details submitted through client website forms - website analytics data, including IP address - correspondence relating to the work 2.2 No special category data under Article 9 is transferred. No criminal offence data. No financial account data. No data relating to children. [If a specific client engagement WOULD involve any of the above, this assessment must be redone for that engagement before work starts.] 2.3 Volume is low. These are small and medium businesses, and the data involved is incidental to building and maintaining their systems rather than the purpose of it. 2.4 Frequency: ongoing for the duration of each engagement. 3. IS THE IDTA ENFORCEABLE IN PERU? 3.1 Peru is a civil law jurisdiction in which contracts freely entered into between parties are binding and enforceable through the courts. 3.2 The importer is an individual resident and economically established in Peru, holding assets and operating businesses there. He is therefore realistically reachable by legal process, which is not always the case with overseas importers. 3.3 The IDTA is governed by the law of England and Wales. A judgment obtained here would need to be recognised in Peru to be enforced against the importer directly, which adds cost and delay. 3.4 Mitigating this: the commercial relationship is direct, continuous and personal rather than arm's length, and the exporter can suspend or end it immediately. In practice that is a faster and more effective remedy than litigation, and it is available at any time. 4. WOULD PERUVIAN LAW OR PRACTICE UNDERMINE THE PROTECTIONS? 4.1 Peru has comprehensive data protection legislation: Ley N° 29733, the Personal Data Protection Act, together with its regulation approved by Supreme Decree 016-2024-JUS, which came into force on 31 March 2025 and replaced the earlier 2013 regulation. 4.2 The 2025 regulation strengthened the regime significantly. It introduced mandatory data protection officers, breach notification within 48 hours, data portability, de-indexing rights, and extended extraterritorial reach. 4.3 There is an independent supervisory authority, the Autoridad Nacional de Protección de Datos Personales, within the Ministry of Justice. It is demonstrably active rather than nominal: it carried out approximately 760 enforcement actions during 2025. 4.4 Data subjects have rights of access, rectification, erasure and objection under Peruvian law, broadly comparable in substance to those under UK GDPR, and a route to complain to the supervisory authority. 4.5 Conclusion on this limb: Peruvian law does not undermine the protections in the IDTA. It reinforces them. Peru's absence from the UK adequacy list reflects the fact that no adequacy assessment has been concluded, not a finding that its regime is inadequate. 5. RISK OF ACCESS BY PUBLIC AUTHORITIES 5.1 The data is ordinary business contact information and website analytics for small UK businesses. It is of no foreseeable interest to any Peruvian public authority. 5.2 Peru does not operate a bulk foreign intelligence collection programme of the kind that has driven adequacy concerns about other countries. 5.3 Any access by a Peruvian authority would require domestic legal process, which is subject to judicial oversight. 5.4 Residual risk assessed as LOW. 6. TECHNICAL AND ORGANISATIONAL MEASURES 6.1 Access to client systems is by individual named accounts with multi-factor authentication. Shared credentials are not used. 6.2 Data in transit is encrypted using TLS. Data at rest on the importer's devices is protected by full-disk encryption. 6.3 Production data is not copied to local machines except where strictly necessary for a specific task, and is deleted immediately afterwards. 6.4 Credentials and access keys are held in a password manager, never in source code, and never transmitted over messaging applications. 6.5 Backups of work product are encrypted before leaving the device. 6.6 On termination of an engagement, access is revoked and any remaining copies of client personal data are deleted. 6.7 The importer must notify the exporter of any suspected personal data breach without undue delay and in any event within 24 hours, so that the exporter can meet its own obligations to the client and to the ICO. 7. CONCLUSION 7.1 Taking together the low sensitivity and volume of the data, the comprehensive and actively enforced Peruvian data protection regime, the low risk of public authority access, the technical measures in place, and the exporter's ability to suspend the transfer immediately, the protections in the IDTA are not undermined by the transfer. 7.2 The transfer may proceed under the IDTA. 7.3 This assessment is to be reviewed annually, or immediately if: - the categories of data change, particularly if special category data becomes involved - the volume increases materially - Peruvian law changes in a way that affects the above - the ICO issues a revised IDTA or updated TRA guidance - a security incident occurs Signed: ______________________________ [YOUR FULL LEGAL NAME], trading as Saltwork Date: [DATE]

IDTA · PART 1 · TABLES TABLE 1 — PARTIES AND SIGNATURES Start date: [DATE] The Exporter Full legal name: [YOUR FULL LEGAL NAME] Trading name: Saltwork Main address: [YOUR UK SERVICE ADDRESS] Official reg no: Not applicable — sole trader, not a registered company Key contact: [YOUR NAME], hello@saltwork.co.uk Signature: ______________________ Date: __________ The Importer Full legal name: Andrés Salamé-Córdova Reina Main address: [HIS FULL ADDRESS, LIMA, PERU] Official reg no: RUC [RUC NUMBER] Key contact: Andrés Salamé-Córdova Reina, [EMAIL] Signature: ______________________ Date: __________ TABLE 2 — TRANSFER DETAILS UK country's law that applies to this IDTA: The law of England and Wales Primary place for legal claims: The courts of England and Wales The Exporter acts as: Processor (acting on the instructions of its clients, who are the controllers) The Importer acts as: Processor (as sub-processor to the Exporter) Whether UK GDPR applies to the Importer: UK GDPR does not apply directly to the Importer's processing Linked agreement: The services agreement between the Exporter and each client, and the written contract between the Exporter and the Importer dated [DATE OF YOUR AGREEMENT WITH ANDRÉS] Term: From the start date above until the linked agreements end, or until either party terminates this IDTA in accordance with the Mandatory Clauses Ending this IDTA when the Approved IDTA changes: The Exporter may end this IDTA in accordance with Section 29 of the Mandatory Clauses Can the Importer make further transfers of the transferred data? NO. The Importer may not transfer the data onward to any third party without the Exporter's prior written consent. Specific restrictions when the Importer may transfer on: Not applicable — onward transfers are not permitted Review dates: Annually from the start date, and immediately on any change to the nature, volume or sensitivity of the transferred data TABLE 3 — TRANSFERRED DATA Categories of transferred data: - Business contact details of client personnel: name, job title, work email address, work telephone number - Contact details submitted by individuals through client website forms: name, email address, telephone number, message content - Website analytics data, including IP addresses and device information - Correspondence relating to the delivery of the services Special category data: None. The parties agree that no special category data under Article 9 UK GDPR, and no criminal offence data, will be transferred. If a specific engagement would require it, the parties will complete a fresh transfer risk assessment before that engagement begins. Relevant data subjects: - Employees and representatives of the Exporter's clients - Individuals who contact the Exporter's clients through their websites - Visitors to the Exporter's clients' websites Purpose of the transfer: Design, development, maintenance, hosting support and technical support of websites and custom software on behalf of the Exporter's clients. The Importer processes the data only on the Exporter's documented instructions. Data retention: For the duration of the relevant client engagement. On termination the Importer will delete all copies of the transferred data, and confirm deletion in writing, unless UK law requires it to be kept. TABLE 4 — SECURITY REQUIREMENTS Security of transmission: All transfers encrypted in transit using TLS 1.2 or above. No transfer of personal data over messaging applications or unencrypted email. Security of storage: Full-disk encryption on all devices with access to the data. Encrypted backups. Credentials held in a password manager, never in source code. Security of processing: Individual named accounts with multi-factor authentication. No shared logins. Access limited to what is needed for the specific task. Production data not copied locally except where strictly necessary, and deleted immediately afterwards. Organisational security measures: Written contract between Exporter and Importer including confidentiality obligations that survive termination. Access reviewed on each engagement and revoked on completion. Technical and organisational measures for onward transfers: Not applicable — onward transfers are not permitted. Personal data breach notification: The Importer will notify the Exporter of any suspected personal data breach without undue delay and in any event within 24 hours of becoming aware of it, with sufficient detail for the Exporter to meet its own obligations to its client and to the ICO.