On 4 June 2021, the European Commission adopted two sets of new
Standard Contractual Clauses (“SCCs”),
taking into account the Schrems II judgment:
- One set is for use between controllers and
processors located in the EU/EEA (or otherwise subject to the
GDPR): Effectively these SCCs contain the
Art.28.3 and Art.28.4 GDPR compulsory wording) (“28.7
SCCs”); and
- The other set is for the transfer of personal data
to Non-EU/EEA third countries (not subject to the
GDPR) (“Third Country
SCCs”).
The newly adopted “Art 28.7 SCCs” and “Third
Country SCCs” come into effect on 27 June
2021 and companies which use the current version of
SCCs (effectively the old SCCs) executed prior to 27
September 2021, have until 27 December
2022 to implement the new ones (provided the
processing operations that are the subject matter of the contract
– with the SCCs – remain unchanged and that reliance on
those SCCs ensures that the transfer of personal data is subject
