What Changed
- EDPB adopted a statement supporting alternative model contractual clauses for onward data transfers.
- European Commission updated its EU SCC FAQs to recognize CoE and RIPD model clauses.
- EDPB issued practical guidance for organizations relying on CoE and RIPD clauses for onward data transfers.
Organizations transferring personal data internationally under European Union Standard Contractual Clauses (SCCs) have recognized options for executing onward data transfers. At its plenary meeting in Brussels on 13 November, the European Data Protection Board (EDPB) adopted a statement supporting the use of alternative model contractual clauses for onward transfers of personal data.
The EDPB statement welcomes recent updates made by the European Commission to its Frequently Asked Questions (FAQs) regarding EU SCCs. Specifically, the updated Commission guidance recognizes that Model Contractual Clauses (MCCs) developed by the Council of Europe (CoE MCC) and those developed by the Ibero-American Data Protection Network (RIPD MCC) may also be used for onward transfers of personal data that was originally received under EU SCCs.
The EDPB and the European Commission cooperated closely on this matter. According to the EDPB, subject to the conditions detailed in the European Commission's FAQs, these additional contractual instruments can ensure an appropriate level of protection for individuals as guaranteed by European data protection law when data is onward transferred.
In addition to supporting the Commission's recognition, the EDPB statement offers practical guidance for organizations seeking to rely on the CoE MCCs or RIPD MCCs for onward transfers. Model contractual clauses are clauses developed by international organizations and third countries, whereas standard contractual clauses are standardized, pre-approved model data protection clauses used to provide appropriate safeguards for transferring personal data to third countries.
This alignment provides cross-border entities and legal professionals handling data originating from the European Union with clarified operational mechanisms when managing compliant onward transfers to secondary recipient organizations.
Who May Be Affected
Organizations and legal practitioners involved in cross-border transfers and onward transfers of personal data subject to EU data protection law.
Cross-Border Context
Applies to onward transfers of personal data originally transferred out of the EU under EU Standard Contractual Clauses to third-country recipients.
What to check next
- Consult the updated European Commission FAQs on EU Standard Contractual Clauses.
- Review the adopted EDPB statement for detailed practical guidance on implementing CoE and RIPD model clauses.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.