If you are transferring data ex-UK still using the original EU SCCs, i.e. the standard data protection clauses issued under European Commission Decisions 2001/497/EC and 2010/87/EU (now often referred to as the old SCCs or in the language of the ICO the “Transitional Standard Clauses”) that boat is sailing at the end of today (21 September 2022) for all new contracts.

Any contracts concluded “on or before 21 September 2022” using the old SCCs will continue to provide appropriate safeguards for the purpose of Art 46(1) of the UK GDPR until 21 March 2024, provided that “the processing operations that are the subject matter of the contract remain unchanged and reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards”. Any new contracts must use the new transfer mechanisms, i.e. the International data transfer agreement or the International data transfer addendum to the European Commission’s standard contractual clauses for international data transfers.

Some organisations have continued to rely on the old SCCs for ex-UK transfers while awaiting news of the US-EU Trans-Atlantic Privacy Framework (for more information see our articles here and here) or the outcome of the negotiations between the UK and the US as one of the UK’s preferred data partnerships. There has been little to report on these developments of late and now the deadline is upon us. Organisations may also think they no longer have the old SCCs in their contracts but it is always prudent to take a look! The long-stop date is 21 March 2024 so there is still plenty of time to switch but any contracts being negotiated now need to be signed or updated to include the correct transfer mechanism.