Final reminder: old form EU SCCs no longer valid after 21 March 2024!

After 21 March 2024, the old form EU Standard Contractual Clauses (SCCs) will no longer apply in relation to international transfers of personal data out of the EU (or UK).

Why is a transfer agreement required?

For companies wishing to transfer personal data from the UK or EU to a “third country”, mandatory safeguards are required where that country is deemed not to have “adequate” levels of personal data security by the EU Commission or UK government. Examples of such countries include Turkey, India and the US. A transfer can simply mean where overseas companies can access personal data stored in the UK or EU, for example in personnel files and client databases. This often applies to group companies sharing personal data among the group. The most popularly utilised safeguards, tend to be in the form of an international data transfer agreement, or “SCCs”.

What are SCCs?

SCCs are a set of prescribed clauses approved by the EU Commission to ensure personal data shared is protected by each contracting party to the clauses. The clauses are often used as an annex to a data sharing agreement or services agreement.

What transfer agreements are valid?

Post Brexit, the UK now has its own international transfer agreements, as well as a UK addendum to the EU SCCs, and the EU Commission has brought out updated versions of its SCCs. Companies must ensure the correct form is used going forwards. Mandatory international data transfer risk assessments must also be completed before progressing with the transfer agreement to ensure personal data will in fact be safeguarded in the “third country”.

What action do I need to take now?

Any agreements in the form of the old EU SCCs will cease to allow the compliant transfer of personal data after 21 March 2024 so companies are urged to act quickly. We recommend reviewing all existing transfer agreements and identifying those relying on the old SCCs as a transfer mechanism. For those agreements where personal data is still being transferred, risk assessments should be carried out as soon as possible and new form agreements implemented thereafter.

If you require assistance with updating or implementing new international transfer agreements, please get in touch.

Madeleine Rhodes