News

GDPR 2 – Is your business ready to be compliant?

Last summer, the European Commission published long-anticipated Standard Contractual Clauses ("2021 SCCs")  which modernised older pre-GDPR versions of the SCCs ("pre-2021 SCCs"), and incorporated new obligations on controllers and processors in light of the GDPR and the Schrems II judgment. Notably, the 2021 SCCs put the transfer impact/risk assessment emphasised in the Schrems II judgment on a mandatory contractual footing. The European Commission also recently published 44 questions and answers dealing with common queries on implementing the 2021 SCCs, which can be accessed here.

A transition period has been counting down since the arrival of the 2021 SCCs in order to allow organisations making international transfers of personal data based on the pre-2021 SCCs to transition to the 2021 SCCs.

There are two timelines organisations should now be working towards to ensure compliance.

UK personal data being processed outside EEA – March 2024

For the EU there are only four months remaining for organisations to adopt the 2021 SCCs as the transition period will end on 27 December 2022.

The next steps for organisations to ensure compliance ahead of this deadlines include:

  • identifying which international data transfer arrangements need to transition to the 2021 SCCs; and
  • ensuring that all transfer impact/risk assessments associated with the transfers are complete and up-to-date.

7SS is supporting business with this activity end to end from identifying contracts in scope to the implementation of the new SCCs. Reach out to one of our team for more information