When the European Commission adopted the new EU Standard Contractual Clauses (new SCCs) for international data transfers earlier this year, we highlighted 3 key dates to be aware of. As one of those dates – 27 September 2021 – has now passed, its timely to remind ourselves why those dates are important.
27 June 2021
- From this date the new EU SCCs could be used by companies transferring data from EEA to non-EEA countries.
27 September 2021
- From this date the old EU SCCs (based on European Commission Implementing decisions (2001/497/EC) and (2010/87/EU)) were repealed. This means that the old EU SCCs cannot be used for any new contracts entered into from 27 September 2021 onwards, in order to legitimise the transfer of personal data from the EEA to non-EEA countries under the EU GDPR. The new SCCs must be used from this date.
27 December 2022
- Existing contracts incorporating the old SCCs remain valid until 27 December 2022 (on the condition that the underlying processing operations remain unchanged and the transfer is subject to appropriate safeguards). This means that companies now have 15 months left to replace all contracts incorporating the old SCCs with the new SCCs.
Next Steps
Replacing legacy SCCs will likely be a significant task for many organisations, and will entail more than simply swapping out the old clauses for the new clauses. It would therefore be prudent for organisations to start taking steps now to review their data flows and identify which data transfer contracts need to be reviewed and replaced.