²ÝÝ®ÊÓƵ

2021 standard contractual clauses and the EU¡¯s GDPR.

While the SCCs are data transfer mechanisms created to guide individual transactions, the GDPR is a broader regulatory framework created to promote data privacy for all EU citizens. It establishes standards for data processing, access, and security, and tough sanctions to be exacted by supervisory authorities for noncompliance.

Legal action under the GDPR prompted a reform of the SCCs. In July 2020, the European Court of Justice (ECJ) issued what is known as the ¡°Schrems II¡± decision in the case of Data Protection Commissioner v. Facebook Ireland Ltd. The court examined the SCCs along with the EU-U.S. Privacy Shield, which was created in 2016 to provide a framework for data transfers from the EU to the U.S.

The case originated with a complaint filed by activist Maximilian Schrems, alleging that the transfer of personal data from Facebook¡¯s Ireland subsidiary to its U.S. headquarters could expose that data to U.S. intelligence agencies in contravention of the GDPR. The ECJ agreed, ruling that the old SCCs and the Privacy Shield didn¡¯t do an adequate job of protecting EU customer data from government access.

However, while the court struck down the Privacy Shield framework, it ruled that the SCCs would still be viable data transfer mechanisms with the addition of new safeguards. In accordance with the ECJ¡¯s decision, in June 2021, the European Commission released an updated version of the SCCs to address gaps and ambiguities in the prior version, provide guidance for a wider range of transfer scenarios, and bring the SCCs in line with the GDPR.

Important dates for SCC compliance.

As of September 27, 2021, the previous version of the SCCs is no longer viable for new data transfers. Data controllers and data processors must use the updated 2021 version of the SCCs in all new DPAs.

Businesses also have to update existing contracts that are noncompliant with the new SCCs. Data controllers and processors transferring EU customer data had until December 27, 2022, to update all of the outdated clauses throughout their data transfer agreements.

Steps to keep your company on track.

Updating an entire portfolio of DPAs may seem like a daunting task on top of all of the other work that a legal or compliance team needs to do to keep up with the GDPR and other jurisdictions¡¯ data privacy regulations. However, it doesn¡¯t have to be if you have the right tools and processes in place.

Here are some practical steps that teams can take to ensure that their organization¡¯s data transfer agreements are compliant with the new SCCs well in advance of the December deadline:

1. Assemble all of the business¡¯s DPAs and any other relevant contracts together in one place.

2. Review all relevant clauses throughout the contract portfolio to identify (a) agreements that are already compliant with the new SCCs (which should include any contracts finalized since September 2021), (b) newly outdated clauses to update by December 2022, and (c) any provisions that were already noncompliant with the prior SCCs (hopefully none).

3. Prepare standardized clauses that are compliant with the new SCCs, if you haven¡¯t already done so for recent DPAs.

4. Prioritize data transfer agreements to update, taking into account present compliance status and the risk exposure created by each noncompliant or soon-to-be noncompliant agreement.

5. Communicate and work closely with all relevant stakeholders, including both internal teams and the business partners on the other side of the table.

6. Update all of your noncompliant contracts with your new standard language, starting with the most urgent and working your way down to the least.

7. Track your organization¡¯s regulatory compliance on an ongoing basis after all parties have signed the newly revised agreements.

How ²ÝÝ®ÊÓƵ supports data processing obligations.

²ÝÝ®ÊÓƵ provides a Universal Data Processing Exhibit (DPE) that defines each party¡¯s responsibilities for processing personal data and establishes clear expectations around security, breach response, and regulatory compliance.

While a data processing agreement (DPA) typically governs how a vendor processes personal data on behalf of a customer, a DPE functions as a broader contractual framework that clarifies roles, safeguards, and operational requirements supporting those obligations.

Remediate efficiently and collaboratively.

Centralize your entire contract portfolio without having to migrate a single document. Create a single source of truth where you can triage and update agreements without any manual data entry or spending precious money and time on outsourced providers.

Draft templates, amendments, and new DPAs based on your ideal language, including the new SCCs. Enforce version control while negotiating with your counterparties, and have everyone sign electronically¡ªall from one end-to-end platform.

Answer questions immediately.

Find any clause in seconds, regardless of how it¡¯s labeled. Get automated reports and notifications on your data privacy obligations. Locate key clauses and identify compliance gaps so you can analyze your business¡¯s risk exposure. Track which contracts have been executed and which haven¡¯t so you don¡¯t leave any loose ends.

Respond promptly to breaches.

Automatically track every notice obligation so you¡¯ll know exactly what to do in the event of a data breach. When you already know every deadline, you¡¯ll have one fewer fire drill to worry about in an emergency.

Adapt confidently.

Identify both compliant and noncompliant clauses throughout your entire contract database. Retroactively track clauses related to data privacy regulations, no matter how many years of agreements you have in place.

Leverage standardized data privacy language for every new contract, whether it¡¯s on your template or third-party paper. Give yourself the time and tools you need to review all of your agreements as other new regulations come into play.

Powerful AI from ²ÝÝ®ÊÓƵ helps businesses navigate new regulations confidently instead of just trying to stay afloat.

Meeting regulatory deadlines doesn¡¯t need to be intimidating or uncertain. Learn more here.

?

This content is provided for general informational purposes only and does not constitute legal advice. While it reflects common industry definitions, ²ÝÝ®ÊÓƵ¡¯s contractual approach may vary depending on specific customer relationships and governing terms.