Standard data protection clauses are deemed to be appropriate safeguards in light of the GDPR and UK Data Protection Act requirements. Performing an international data transfer requires either the receiving country to be deemed adequate or for appropriate safeguards to be in place. One such safeguard is standard data protection clauses for an international data transfer. These cluses are a series of contractual statements which can be added to contracts between the transferring parties, which provide legally binding obligations on the parties to protect the data subjects personal data. These clauses must be adopted by the supervisory authority and cannot be altered from their approved form.
Since supervisory authorities have already approved a standard set of clauses, this safeguard is simple for an EU or UK based organisation to adopt. These clauses cannot be altered as they have been agreed by each regulator. The challenge is likely to come in gaining commitment from the none EU organisation to sign up to the clauses who may not see the advantage of such clauses and may wish to alter them.
Access to the UK standard contractual clauses, can be found here: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/
Access to the EU clauses, can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
How can ProvePrivacy Help?
Whilst this may appear to be a complex subject, ProvePrivacy helps to guide the Data Champion in understanding what safeguards can be applied through it’s dynamic activity workflows.
