Deadline of 27 December looms for adopting new EU SCCs

Companies using the EU Standard Contractual Clauses (SCCs) must ensure that they transition from the old contracts to the GDPR-revised new SCCs by 27 December 2022.

The new SCCs, that can be used for data transfers from the EU to countries outside the European Economic Area, were adopted in June 2021. These modernised SCCs replace the three sets of SCCs that were adopted under the previous Data Protection Directive 95/46. Since 27 September 2021, it is no longer possible to conclude contracts incorporating these earlier sets of SCCs.

Contracts that were concluded before 27 September 2021 have benefitted from a transitional period which is now coming to an end. After 27 December 2022, the previous Standard Contractual Clauses are no longer considered to provide an "appropriate guarantee" for the export of personal data.

On 25 May 2022, the EU Commission issued Questions and Answers on the use of SCCs.

Another method for data transfers to third countries is using Binding Corporate Rules. Privacy Laws & Business is organising a Workshop, in cooperation with Hogan Lovells, “Building a common EU and UK BCR framework” in London on 12 December 2022.