In July 2020, the Court of Justice of the European Union ruled that companies should undertake additional diligence in order to rely on Standard Contractual Clauses (SCCs) for international transfers of data to non-EU jurisdictions. The ruling also applies to other transfer tools such as BCRs. Where this diligence does not confirm that an adequate level of protection is assured, companies need to put in place supplementary measures to support the protections in the SCCs. The Court also ruled that Privacy Shield (a US self-certification privacy compliance regime) was invalid.

The European Data Protection Board has published guidance on what these supplementary measures might look like and what European Essential Guarantees are required to be reflected in local laws that permit access to personal data by public authorities. 

The Schrems II ruling affects the transfer of personal data from the EU/UK to jurisdictions outside the EU/UK. 

So, if, in the course of your business, you transfer data from EU/UK to non-EU/UK (such as to a cloud service provider) you have to adopt a new level of enhanced diligence on data protection and consider additional measures for each transfer or provider.

Dentons has developed a Transfer Impact Assessment Methodology with bespoke templates and process flows in order to enable companies to undertake the required enhanced diligence and validate international transfers of data going forward.

Contact us today for more information.