All Old EU Standard Contractual Clauses For EEA Data Export Must Be Replaced By 27 December 2022

With all old EU Standard Contractual Clauses (SCC) for data export of EEA personal data needing to be replaced by 27 December, specialist lawyers are advising businesses on the steps to be taken now to avoid an unwanted data nightmare before Christmas.

While many are aware that any old EU SCC’s need to be changed to new UK agreements following Brexit, lawyers at Irwin Mitchell are reminding business that agreements relating to the export of EU data using old SCCs must be updated to include the new versions by 27 December 2022.

Any use of old SCCs after this date will mean the export of personal data from the EEA is not compliant with General Data Protection Regulation (GDPR), leaving just weeks remaining to ensure this is complete before the Christmas period.

Many businesses have put in place EU SCCs over the years, to legitimise the export of personal data from the EEA to other countries. They are often used with suppliers where there is hosting of personal data in the US for example, or where there are intra-group arrangements in place.

New SCCs were adopted by the European Commission on 4 June 2021 and following the transition period, any agreements still using old SCCs for EEA data need to be updated to include the new versions.

The new SCCs are modular to cover different types of data sharing, such as Controller to Processor, Controller to Controller, Processor to Controller and Processor to Processor and can be found here.

Businesses unsure whether the old EU SCCs have been used, can check if any of the following documents have been included, with the table below. If these documents are still in place, businesses need to move to the new versions.

Expert Opinion

“With so much economic uncertainty, there has been a lot for businesses to take on board recently. We know many remain concerned about data protection issues post Brexit and this SCC change is something that could easily have gone under the radar.

“It’s easy to focus on the new UK agreements needed by 2024, forgetting that the SCCs need to be updated to new versions for EEA data now. There has already been a transition period and the time to act is now for those who have not yet done so.

“Following Brexit, the UK has taken its own approach on SCC’s and issued its own International Data Transfer Agreement, plus an Addendum to work with the new SCCs. While the changeover data for the UK is different and existing arrangements relating to UK data will need to be changed to the new UK agreements by the 2024 deadline, that doesn’t alter the fact that this year’s deadline to changeover from the old SCCs for EEA data is in force.

"To avoid a nasty surprise that no one wants to see on their Christmas list, it’s well worth checking all is in place and taking advice sooner rather than later now if you’re unsure of next steps.” Joanne Bone, Partner