European Commission Adopts New Service Providers Standard Agreement (Controller-Processor SCCs)

The new standard agreement for service providers (which we'll refer to as the Controller-Processor SCCs) adopted by the European Commission on June 4th was understandably a bit overshadowed by the release on the same date of the Standard Contractual Clauses for data transfers (see blog post here).  But the new Controller-Processor SCCs, which organizations can use with their service providers to meet their GDPR Article 28 obligations, is another welcome addition to the EU's small but growing library of standard documents. 

If you are planning to use the new SCCs for data transfers, you will find that the Controller-Processor SCCs terms are already built in, so you don't need to put the separate Controller-Processor SCCs in place.  However, if you are dealing with a services agreement that doesn't involve a transfer of personal data out of the EEA (or you are relying on a different lawful basis of the transfer) the Controller-Processor SCCs may be just the ticket.