BCLP Global Data Privacy FAQs: What’s the timing for using the new EU SCCs for data transfers?

This depends on whether you are looking at (a) entering into new data transfer agreements or (b) repapering existing ones.  The longstop date for repapering existing agreements is 27 December 2022; however, the new EU SCCs must be used for all new transfer agreements from 27 September 2021. Note that these new SCCs apply only to EU outbound transfers of personal data; as we explained in our earlier FAQ, the new EU SCCs have not been approved for UK outbound transfers.

On 27 June 2021 the European Commission’s revised set of standard contractual clauses (the “new SCCs”) became authorised under the EU General Data Protection Regulation (2016/679) for use in outbound EU personal data transfers agreements to third countries. They can be found here.

In terms of transitioning to the new SCCs, the following key dates should be bookmarked:

• Authorisation for the older sets of standard contractual clauses (the “old SCCs”) will be repealed on 27 September 2021. From this date, the old SCCs cannot be used as a valid transfer mechanism for “new” transfers, meaning that any new agreements relying on “model” EU data transfer clauses must use the new SCCs. For new agreements entered into before 27 September 2021, it is still possible to use the old SCCs.
• For existing agreements that were entered into before 27 June 2021, there is an 18 month grace period in which to conduct a “repapering” exercise. This means that such agreements will need to be amended to incorporate the new SCCs by 27 December 2022. (An earlier, immediate “re-papering trigger” can also arise if the processing operations under an existing agreement change ahead of 27 December 2022). This repapering deadline will also apply to any “new” agreements entered into before 27 September 2021 which utilise the old SCCs.

If you have any questions, please contact a member of BCLP’s Global Data Privacy and Security team. For an explanation of applicable restrictions on personal data flows, see our FAQ here.