New Standard Contractual Clauses for International Data Transfers and Data Processing Agreements

Standard Contractual Clauses (“SCCs”) are a contract appendix with provisions that control the operation of personal data, whose main purpose and function is to ensure the appropriate protection safeguards for transferring personal data outside of the European Union/European Economic Area to third countries (international transfers). SCCs are a clear choice for situations in which data processors or controllers are based in countries recognized by the European Commission as “not safe” from the perspective of ensuring an adequate level of personal data protection.

In this particular case, the SCCs adopted in 2001 and 2010 under the Data Protection Directive 95/46/European Commission are being replaced with the new ones, since they are intended as an improvement over the previous standards. The new SCCs are to be proven as a better solution in the field of long and complex processing chains, as they provide greater flexibility. Besides that, unlike the old SCCs, which only applied on the controller to controller and controller to processor transfers outside of the European Union/European Economic Area, the new SCCs include different modules that parties may select, conclude, and complete, depending on the circumstances of the transfer, such as:

• processor to processor,
• processor to the controller, or
• processor to sub-processor.

Finally, the new SCCs take into effect on 27 June 2021, whilst the old SCCs are not to be repealed straight away but 3 months after the entry into force of the new ones. As far as the usage of the old SCCs goes, they may be used for new data transfers/contracts during the transition period (which amounts to the additional 15 months, i.e. 27 December 2022), but only for the performance of contracts concluded between the data exporters and data importers before the date of their repeal.

By Katarina Zivkovic, Senior Associate, and Aleksandra Bijeljac, Trainee, Samardzic, Oreski & Grbovic