The clock is ticking! The deadline for switching to the new EU Standard Contractual Clauses (SCC) for data transfers between the EU and non-EU countries is December 27, 2022. As of that date, data controllers and processors around the world that process the personal data of EU residents will no longer be able to rely on the old SCCs without violating the General Data Protection Regulation (GDPR). In other words, companies are legally obligated to replace all previously used SCCs with the new ones, and should be able to demonstrate having done so in case of an audit.  

If your U.S.-based company collects or otherwise has access to the personal data of European residents, you may be asked by your European clients or U.S.-based clients who give you access to such data to complete a “Schrems” questionnaire to assess potential exposure to U.S. surveillance and other laws, such as FISA 702 or EO 12333. The purpose of this request is to enable the completion of a Transfer Impact Assessment (TIA).

At long last, the new standard contractual clause (SCCs) are here!

Since the adoption of the General Data Protection Regulation (GDPR), U.S. companies have invested a great deal of time and money in their compliance efforts; yet for many, their work is far from complete. For U.S. data importers, the July 2020 invalidation of the EU-U.S. Privacy Shield has left former “self-certified Shield” companies forced to find a new mechanism by which to lawfully transfer EU data into the U.S. Many of these companies will likely adopt the new set of standard contractual clauses (SCCs), once they are finalized by the European Commission.