The European Commission published two sets of new standard contractual clauses (SCCs) governing cross-border data transfers and data exchanges between controllers and processors (i.e., service providers), marking the first updates to SCCs in more than a decade. They came into force on 27 June 2021.
The new clauses are a welcome update to the landscape of personal data exports from the EU and will require some work from affected organisations, particularly if they are required to migrate from the previous SCCs.
There are a number of key changes to be aware of. Helpfully, the new SCCs are in a modular format which enable processors and controllers to select the relevant provisions that are applicable to them. Meanwhile, for the first time, the new SCCs acknowledge that data may be exported by data processors, either to a data controller or another data processor. This was a significant gap in the previous SCCs.
Transfers of personal data using the previous SCCs will cease to be valid after two short transition periods: for new personal data transfers, the previous SCCs can only be used until 27 September 2021; for existing data transfers, the previous SCCs must not be used after 27 December 2022.
For more information on new SCC’s click here.
Source: cms-lawnow.com