What are standard contractual clauses?

Standard contractual clauses are one of the simplest and most frequently used tools for ensuring personal data protection guarantee, which is required by the General Data Protection Regulation (“GDPR”). These are model texts of contracts, which can be used for preparing respective contractual documentation in the GDPR area. 

Adoption of new standard contractual clauses

From 27 June 2021, two groups of new standard contractual clauses were issued, namely: (i) contractual clauses for transfer of personal data from the EU or EEA to these countries and (ii) contractual clauses for contracts on personal data processing within the EU and EEA. These standard contractual clauses are contained directly in Commission Implementing Decisions (EU) 2021/914 and (EU) 2021/915, which can be found at the www.eur-lex.europa.eu website.

Clauses for transfer of personal data from the EU or EEA to third countries 

In its Schrems II. judgment in July 2020, the European Court of Justice declared the so-called EU–US Privacy Shield invalid and it thereby made transfer of personal data to the USA more difficult. The EU–US Privacy Shield (successor of the previously cancelled Safe Harbor programme) served to enable American companies to receive personal data from countries of the European Union in a simplified way, based on certification. In its judgment, however, the EU court of justice noted that given the extensive powers of US intelligence services, it is not possible to consider personal data protection in the US equal to that in the EU. Such a situation is contrary to the stipulations of the Charter of Fundamental Rights and Freedoms of the European Union, and the Court of Justice therefore cancelled this programme. It also noted that if the legal system of a third country prevents personal data from being adequately protected, it is not possible to use standard contractual clauses here, either.

From the middle of the year 2020, companies that transfer personal data to third countries (especially the US) were therefore awaiting new standard contractual clauses impatiently. These were presented on 12 November 2020 as part of two implementing decisions of the European Commission and their final version was published on 4 June this year.

Clauses for contracts on processing personal data within the EU and EEA

These new standard contractual clauses can be used when transferring personal data within the EU and the EEA. They can be used in contracts made between administrators and processors under article 28 paragraph 3 and 4 of GDPR. 

Obligations arising from the adoption of new standard contractual clauses

The new standard contractual clauses can be used from 27 July 2021. In case of personal data transfer to third countries, the “old” contractual clauses can be relied on under certain conditions until 27 December 2022. In general, though, it is recommended that contracts containing old contractual clauses be updated as soon as possible.