European Commission Publishes Final Version of SSC, Imposes Obligations on Data Controllers and Processors

Written by Achieved Compliance

On June 4, 2021, the European Commission published the final version of the implementing decision on standard contractual clauses (“SCC”) for transfers of personal data to third countries under the EU General Data Protection Regulation (“GDPR”). The Commission also released the final version of the new SCCs. The new version of SCC is in part a response to the decision in the Schrems II case, which raised questions about whether they provide necessary protections for the trans-Atlantic transfer of data.

The guidance makes clear that companies using SCCs will face new compliance challenges. The implementing decision makes the important point that the controllers and processors will need to do more in advance of signing them.

To meet SCC requirements, companies, whether data importers or exporters, must understand the nature and extent of the transferred data and establish necessary protections to comply with the SCCs' requirements. Stated simply, companies will need to conduct a data protection impact assessment to understand what risks the transfer of data will raise and take steps to address them.

Companies will also need to document the steps it takes to fulfill the requirements of the SCCs.

The implementing decision also imposes significant additional requirements:

  • The controller and processor should be able to demonstrate compliance;
  • The importer should maintain appropriate documentation for the processing activities for which it is responsible;
  • The data importer must promptly inform the data exporter if it becomes unable to comply with the clauses, for any reason.
  • Should the data importer breach the clauses or be unable to comply with them, the data exporter should end the transfer of data and, in serious cases, have the right to terminate the contract, as it concerns the processing of personal data under the SCCs.

Clearly, this decision means organizations have to take far more significant action than previously. Organizations use SCCs to ensure they implement appropriate data protection safeguards for international data transfers. Therefore, the controller or processor transferring the personal data to a third country (the ‘data exporter’) and the controller or processor receiving the personal data (the ‘data importer’) can incorporate those standard contractual clauses in a wider contract and add other clauses or additional safeguards, provided they do not contradict the standard contractual clauses or prejudice the fundamental rights or freedoms of data subjects. Encouragement is given for controllers and processors to offer additional safeguards through contractual commitments supplementing the standard contractual clauses.

All organizations will likely need to replace the old SCCs with the new SCCs by approximately December 2022 at the latest. For many organizations with a large number of contractual relationships, that means time is of the essence.

Achieved Compliance offers expert support and a clear action plan. Contact us today.

PRIVACY BLOG

New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies](/content/blog/article-27-representation/index.html)

The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law](/content/blog/the-data-use-and-access-act-2025-duaa-key-changes-to-data-protection-law/index.html)

Privacy Compliance: Why Software Solutions Could Put You at Risk](/content/blog/privacy-compliance-why-software-solutions-could-put-you-at-risk/index.html)

The Troubling Cuts to Medical Research](/content/blog/the-troubling-cuts-to-medical-research/index.html)

ARE YOU CREATING PRIVACY ISSUES WITH AI?](/content/blog/are-you-creating-privacy-issues-with-ai/index.html)

European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation](/content/blog/standard-contractual-clauses/index.html)

Dutch Data Protection Authority Fines Uber for Storing Personal Data in U.S. Without Required Protections](/content/blog/dutch-data-protection-authority-fines-uber-for-storing-personal-data-in-u-s-without-required-protections/index.html)

New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy](/content/blog/new-york-state-attorney-generals-office-issues-guidance-on-tracking-technologies-and-privacy/index.html)

Spanish Data Authority Fines Data Processor for Failure to Assess and Address Risks of Security Breach](/content/blog/spanish-data-authority-fines-data-processor-for-failure-to-assess-and-address-risks-of-security-breach/index.html)

Connecticut Attorney General’s Office Releases Report on New Data Privacy Law](/content/blog/connecticut-attorney-generals-office-releases-report-on-new-data-privacy-law/index.html)

Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action.
read more](/content/blog/data-protection-commissioner-of-ireland-dpc-investigation-focuses-on-location-data/index.html)