Out With The Old, In With The New SCCs

As of September 27, 2021, the European Commission requires controllers and processors to rely on the recently updated Standard Contractual Clauses (SCCs) for any new contracts governing personal data transfers from the EEA. (Existing contracts can continue to use old SCCs until December 27, 2022.)  This post provides an overview of what's in the new SCCs and how they compare to the old clauses they replace.

The Need for New Standard Clauses.  Like the old SCCs, the new SCCs are model data transfer provisions designed to provide an "adequate" level of data protection in countries that have not received an adequacy determination ("third countries").

A lot has changed, however, since the European Commission developed the old SCCs; and the SCCs were due for an update.  The old SCCs were based on the GDPR's predecessor, the Data Protection Directive 95/46/EC, and only addressed controller-to-controller transfers (issued in 2001) and controller-to-processor transfers