General Data Protection Regulation: new rules on transferring personal data to recipients in countries outside the EU

The data protection landscape is changing constantly. The EU General Data Protection Regulation (“GDPR”) came into force on 25 May 2018. The GDPR has introduced a number of rules on transferring personal data to recipients in countries outside the EU, including:
 

• • transfers on the basis of an adequacy Commission decision,
  • transfers subject to appropriate safeguards, including transfer on the basis of the standard data protection clauses adopted by the Commission,
  • transfers on the basis of binding corporate rules.

 
The most common tools to secure data transfer outside the EU have been so far the standard contractual clauses. These clauses were in force on the basis of decisions of the European Commission 2001/497/EC and decision 2010/87/EU.

Now, the European Commission decided to modify these rules by drafting the new standard clauses which should be used when personal data is being transferred outside the EU. Standard contractual clauses address different data transfer scenarios, i.e .: data transfer between administrators, transfer of data by the controller to a processor in a third country, transfers between processors, transfer of data by the processor to the controller in a third country.
 
What are the new standard clauses and since when the new rules apply?
 
From 27 September 2021 the EU companies need start to use new standard contractual clauses for the data transfers outside the EEA according to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council and Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of GDPR and Article 29(7) of GDPR.
 
The previous standard clauses will be in force until 27 December 2022, which means that the EU companies will have 18 months from the date of publication of the implementing decisions in the EU Official Journal to replace contracts using the current standard contractual clauses with the new ones.