On 4th June 2021, the European Commission adopted two sets of NEW standard contractual clauses (SCCs):
- for use between controllers and processors1 :
These are the SCCs to be part of the contract between controllers and processors under Article 28(3) and 28(4) of the GDPR
- for the transfer of personal data to the third countries2:
These are the NEW SCCs replacing the old SCCs providing safeguards pursuant to Article 46(1) and 46(2)(c) of the GDPR for the transfer of personal data to third countries
The NEW SCCs take into account the Schrems II judgment of the Court of Justice as well as the joint opinion of the European Data Protection Board and the European Data Protection Supervisor, feedback from stakeholders during a broad public consultation, and the opinion of Member States' representatives.
The SCCs are pre-approved hence, they will be required to be implemented as-is. As highlighted by European Commission in their press release3, companies using the new SCC templates will meet the data protection requirements of third-party contracts as well as international transfer.
Furthermore, the SCC for transfers of personal data to third countries provides a modular structure giving the flexibility to cover various transfer scenarios within one single document i.e., transfers from the controller to controller, from the controller to the processor; from processor to processor, and from processor to controller. This means that the SCCs can be adapted by using certain modules and omitting others, depending on the specific details of the respective data transfer
Implementation Period
- The decisions adopting the standard contractual clauses will enter into force on 27 June 2021.
- Former standard contractual clauses will be repealed on 27 September 2021.
- Contracts concluded before 27th September 2021 that rely on former standard contractual clauses shall be considered valid for 15 months ending on 27 December 2022, within the meaning of Article 46(1) of the GDPR
FAQs
What changes for us?
- Organizations need to review their existing contracts with the third parties (controllers and processors) and implement the appropriate revised SCCs before the enforcement date
What is the enforcement date? Is there any grace period during which I can keep using old SCCs?
- Former standard contractual clauses will be repealed on 27 September 2021.
- Contracts concluded before 27th September 2021 that rely on former standard contractual clauses will be considered valid for 15 months (i.e., 27 December 2022), under Article 46(1) International Transfer of the GDPR.
What are the next steps for us?
You need to follow the next steps for compliance:
- Identify the valid NEW SCCs dependent on the relation with the third party
- Controller to Controller
- Controller to Processor
- Processor to Processor
- Processor to Controller
- Shortlist the applicable modules from the single document dependent on the relation with the third party.
- Use revised SCCs for any NEW agreements after 27th September 2021.
- Determine which agreements will expire by 27th Dec 2022 and plan for using revised templates.
How can Riskpro help?
- Before the new SCCs come into the force, Riskpro will share with our ongoing/new privacy engagements the appropriate SCCs for different third parties
- Controller to Controller
- Controller to Processor
- Processor to Processor
- Processor to Controller
Footnotes
1. See Commission Implementing Decision 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation 2016/679 and Article 29(7) of Regulation 2018/1725.
2. See Commission Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation 2016/679.
3. See European Commission Press Release