Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 23 DECEMBER 2022

EU SCC Looming Deadline

Mayer Brown
Mayer Brown
Contributor
Mayer Brown

Mayer Brown

Mayer Brown is a leading international law firm positioned to represent the world’s major...

View firm profile
Explore more from Mayer Brown

Companies that rely on standard contractual clauses ("SCCs") for transferring personal data from the European Economic Area ("EEA") to jurisdictions not considered to offer an adequate...

European UnionPrivacy
Mark Prinsley
Mark Prinsley
Oliver Yaros
Oliver Yaros
Dr. Ulrich Worm
Dr. Ulrich Worm
David Simon
David Simon
Björn Vollmuth
Björn Vollmuth
Ana Hadnes Bruder
Ana Hadnes Bruder
Benjamin Beck
Benjamin Beck
Valerie Vanryckeghem
Valerie Vanryckeghem
Reece Randall
Reece Randall
+2 more
Author LinkedIn connections

Companies that rely on standard contractual clauses ("SCCs") for transferring personal data from the European Economic Area ("EEA") to jurisdictions not considered to offer an adequate level of data protection under the EU General Data Protection Regulation must ensure that none of their existing contracts use the old SCCs after 27 December 2022.

Businesses are required to update their existing contracts with customers, vendors and entities in their corporate group to include the European Commission's new SCCs to legally transfer personal data from the EEA to non-adequate jurisdictions (such as the United States).

While many companies are towards the end of the repapering process from the old to the new SCCs, more than a decade of using the old SCCs and the new requirement to carry out transfer impact assessments means that some businesses might find it difficult to meet the deadline for all their contracts.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Visit us at mayerbrown.com

Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the “Mayer Brown Practices”). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC (“PKWN”) is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. “Mayer Brown” and the Mayer Brown logo are the trademarks of Mayer Brown.

© Copyright 2024. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Ten AI Giants, One Regulator And A Lesson For Everyone Else: What The ICO’s Foundation Model Report Really Tells Us

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

To Fine Or Not To Fine: EDPB Confirms Default Position In GDPR Enforcement Should Be To Fine

The European Data Protection Board has published draft guidelines proposing a fundamental shift in GDPR enforcement: a presumption that fines should be imposed for non-minor infringements, with a deliberately low bar for establishing negligence. Organizations will need to demonstrate robust compliance programs and documented decision-making to potentially avoid penalties, as regulators move from asking "should we fine?" to "can we justify not fining?"
GlobalPrivacy
Crowell & Moring LLP
Crowell & Moring LLP
Article

The ICO's Agentic AI Call For Evidence: What You Need To Know

The UK's Information Commissioner's Office has launched a six-week consultation on agentic AI systems, examining how data protection law applies to autonomous AI agents that can make decisions and take actions with minimal human oversight. The call for evidence focuses on six critical themes including data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful bases for processing personal data.
United KingdomPrivacy
TLT
TLT
Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

Private CCTV, Ring Doorbells And Police Investigations: Where Does UK GDPR Draw The Line?

Domestic surveillance technology has evolved from simple security cameras to sophisticated smart systems that may inadvertently create legal obligations for homeowners. When does a Ring doorbell or CCTV system transform an ordinary citizen into a data controller subject to UK GDPR, and what are the implications of millions of private cameras forming an unregulated surveillance network?
United KingdomPrivacy
HCR Law
HCR Law
Article

DOL Announces Enforcement Actions Against Employers In H-1B And PERM Fraud Probe

The Trump Administration has launched an unprecedented enforcement action suspending permanent labor certification processing for eight major employers, linking immigration sponsorship to layoff histories and recruitment practices. This development signals a fundamental shift in how the government evaluates employer access to H-1B and green card programs, with investigations already underway and subpoenas served.
United StatesEmployment and HR
Mayer Brown
Mayer Brown
Article

Landmark DoorDash Settlement Confirms NYC DCWP’s Aggressive Enforcement Posture

New York City's Department of Consumer and Worker Protection secured a landmark $131.5 million settlement with DoorDash, marking the largest worker settlement in the city's history and the largest involving food delivery workers nationwide. The agreement provides over $115 million in direct compensation to more than 260,000 delivery workers who were underpaid, unpaid, or paid late, while establishing a comprehensive three-year compliance monitoring program.
United StatesEmployment and HR
Mayer Brown
Mayer Brown
Article

Trump Administration Announces New Enforcement Actions Against Employers In H-1B And PERM Fraud Probes

The Trump Administration has launched an unprecedented investigation into H-1B visa and PERM labor certification programs, with the Department of Labor's Office of Inspector General issuing dozens of subpoenas and suspending employers' ability to process applications. Federal agencies are deploying new enforcement tools including whistleblower programs and criminal prosecution threats...
United StatesImmigration
Mayer Brown
Mayer Brown
Article

EU’s CBAM Downstream Extension And Anti-Circumvention Amendments: The Road To Trilogue

The European Union's Carbon Border Adjustment Mechanism is undergoing critical legislative refinement as the Commission, Council, and Parliament have each established distinct positions on extending CBAM to downstream goods and strengthening anti-circumvention measures. With trilogue negotiations now underway and the first political trilogue scheduled for October 2026, significant divergences remain between the institutions on scope, exemptions, and enforcement mechanisms that will shape the final framework
European UnionEnvironment
Mayer Brown
Mayer Brown