The European Commission has adopted new Standard Contractual Clauses (SCCs) for transfers of personal data from the EEA to third countries (Decision (EU) 2021/914).
Key features
- A modular approach covering controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers.
- Built-in obligations reflecting the Schrems II judgment, including documented transfer impact assessments.
- Requirements for importers to handle and challenge government access requests.
- Detailed technical and organisational security measures in an annex.
The old SCCs can no longer be used for new contracts from 27 September 2021, and existing contracts must be migrated by 27 December 2022.
Note: for transfers from the UK, the ICO is consulting on its own UK transfer tools.
Source: Commission Implementing Decision (EU) 2021/914 (EUR-Lex)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
