Navigating The New Standard Contractual Clauses For International Data Transfers Under The GDPR

The final version of the new standard contractual clauses ("SCCs") were published by the European Commission on June 4, 2021. Many organizations that transfer or receive personal data originating in the European Economic Area ("EEA") outsideis  the EEA will be required to implement these SCCs with their customers, suppliers and affiliates by December 2022 to comply with the EU General Data Protection Regulation ("GDPR"). This is perhaps the most significant GDPR development since the passage of the GDPR. We had foreshadowed this impending development last week.

SCCs are template data transfer agreements that allow data exporters to transfer data to countries outside the EEA that the European Commission identifies as providing an "inadequate" level of data protection (including Australia, Brazil, China, India and the US). (Organizations that are subject to the GDPR cannot make such data transfers unless they use SCCs or an alternate data transfer mechanism approved