International transfers of personal data: less than two months to replace the old standard contractual clauses – are you ready?

SCCs are standardised and pre-approved model data protection clauses that can be incorporated into agreements on a voluntary basis to comply with data protection requirements. The new SCCs take into account the Schrems II judgement by the Court of Justice of the European Union issued in the summer of 2020.

Transitional period is about to end – now is the time to take action

The adoption of the new SCCs on 27 June 2021 launched an 18-month transitional period during which companies using the old SCCs must update their agreements and replace the old SCCs with the new ones. New agreements to transfer data that were concluded after the new SCCs were adopted (i.e. new data transfers) had to be based on the new SCCs since 27 September 2021 already.

The deadline for replacing the old SCCs is now less than two months away as the transitional period ends on 27 December 2022. If your organisation has not yet taken action, now is the time.

What needs to be done?

The EU and the US are currently working on a new framework that will govern the transfer of personal data from the EU to the US. As we discuss in more detail in this blog, the new transfer mechanism is not expected to enter into force before the spring of 2023, and the SCCs adopted by the Commission will remain a key transfer mechanism in transfers of personal data outside the EU/EEA. For the time being this also applies to data transfers to the US. 

To learn more about the contents of the new SCCs, read this article.