Overview

EU-approved “model clauses” are often used by companies to comply with their obligation to protect personal data transferring out of the European Economic Area (EEA) to suppliers. Beginning 15th May 2010, organisations will be required to use an updated set of controller-to-processor model clauses for new transfers of personal data or for any existing transfers where the purpose of the transfer or nature of the processing activities changes.

The new clauses are intended to simplify the contracting processes by allowing for onward transfers of personal data from a non-EEA importer to subcontractors also located outside the EEA. However, the new clauses still lead to considerable administrative burden.