Privacy/Data Protection Law – New European Standard Controller to Processor Model Terms

Originally published 16 June 2010

Keywords: privacy, data protection law, transfer, EU, contractual clauses

On 5 February 2010, the EU Commission decided to update the standard contractual clauses for the transfer of personal data from data controllers to data processors located in non-EU countries that are not recognised as offering an adequate level of data protection.

These came into force on 15 May 2010 and replace the previous standard contractual clauses for data controller to data processor transfers which had been in use since 2001 but must no longer be adopted.

The new standard model terms must now be used where:

• A new arrangement governing the transfer of personal data from a data controller to data processor outside of the EU is going to be entered into; or