DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Note to copy:
The HubSpot Data Processing Agreement is made available athttps://legal.hubspot.com/dpa and is incorporated into the HubSpot Customer
Terms of Service available at https://legal.hubspot.com/terms-of-service, as
specified in the HubSpot Customer Terms of Service.
For Customers that would like to receive a signed copy of the HubSpot Data
Processing Agreement, we have made this copy available to you. This copy
includes signatures on the Data Processing Agreement version last modified
June 4, 2024, followed by a complete copy of the Standard Contractual
Clauses and UK Addendum, which are incorporated by reference within the
DPA. No changes made to this copy are agreed to by HubSpot, Inc. or its
affiliates.
Please note that we update the Data Processing Agreement as we describe inthe ‘General Provisions’ section below. Current Data Processing Agreement
terms are available at https://legal.hubspot.com/dpa and archived Data
Processing Agreement terms are available at https://legal.hubspot.com/legalstuff/archive.
If you have any questions, please contact your HubSpot representative.

HubSpot Data Processing Agreement
Last Modified: June 4, 2024
This HubSpot Data Processing Agreement and its Annexes (“DPA”) reflects the parties’agreement with respect to the Processing of Personal Data by us on behalf of you in
connection with the HubSpot Subscription Services under the HubSpot Customer
Terms of Service available at https://legal.hubspot.com/terms-of-service between you
and us (also referred to in this DPA as the “Agreement”).
This DPA is supplemental to, and forms an integral part of, the Agreement and iseffective upon its incorporation into the Agreement, which may be specified in theAgreement, an Order Form or an executed amendment to the Agreement. In case of
any conflict or inconsistency with the terms of the Agreement, this DPA will takeprecedence over the terms of the Agreement to the extent of such conflict orinconsistency.

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

We update these terms from time to time. If you have an active HubSpot subscription,
we will let you know when we do via email (if you have subscribed to receive email
notifications via the link in our General Terms) or via in-app notification. You can findarchived versions of the DPA in our archives at https://legal.hubspot.com/legalstuff/archive.
The term of this DPA will follow the term of the Agreement. Terms not otherwise definedin this DPA will have the meaning as set forth in the Agreement.
1. Definitions
2. Customer Responsibilities
3. HubSpot Obligations
4. Data Subject Requests
5. Sub-Processors
6. Data Transfers
7. Demonstration of Compliance
8. Additional Provisions for European Data
9. Additional Provisions for California Personal Information
10. General Provisions
11. Parties to this DPA
Annex 1 - Details of Processing
Annex 2 - Security Measures
Annex 3 - List of Sub-Processors
1. Definitions“California Personal Information” means Personal Data that is subject to the protectionof the CCPA.
"CCPA" means California Civil Code Sec. 1798.100 et seq. (also known as theCalifornia Consumer Privacy Act of 2018, as amended by the California Privacy Rights
Act of 2020 or “CPRA”).
"Consumer," "Business," "Sell," "Service Provider," and “Share” will have the meanings
given to them in the CCPA.
“Controller” means the natural or legal person, public authority, agency or other bodywhich, alone or jointly with others, determines the purposes and means of theProcessing of Personal Data.
“Data Privacy Framework” means the EU-U.S. Data Privacy Framework, the Swiss-U.S.
Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework
self-certification programs (as applicable) operated by the U.S. Department ofCommerce; as may be amended, superseded or replaced.
2DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2“Data Privacy Framework Principles” means the Principles and Supplemental Principles
contained in the relevant Data Privacy Framework; as may be amended, superseded or
replaced.
“Data Protection Laws” means all applicable worldwide legislation relating to dataprotection and privacy which applies to the respective party in the role of Processing
Personal Data in question under the Agreement, including without limitation European
Data Protection Laws, the CCPA and other applicable U.S. federal and state privacy
laws, and the data protection and privacy laws of Australia, Singapore, and Japan, ineach case as amended, repealed, consolidated or replaced from time to time.
“Data Subject” means the individual to whom Personal Data relates.
"Europe" means the European Union, the European Economic Area and/or theirmember states, Switzerland and the United Kingdom.
“European Data” means Personal Data that is subject to the protection of European
Data Protection Laws.
"European Data Protection Laws" means data protection laws applicable in Europe,
including: (i) Regulation 2016/679 of the European Parliament and of the Council on theprotection of natural persons with regard to the processing of personal data and on thefree movement of such data (General Data Protection Regulation) ("GDPR"); (ii)
Directive 2002/58/EC concerning the processing of personal data and the protection ofprivacy in the electronic communications sector; and (iii) applicable national
implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom
domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UKGDPR"); and (iv) Swiss Federal Data Protection Act and its Ordinance ("Swiss DPA"); in
each case, as may be amended, superseded or replaced.
“Instructions” means the written, documented instructions issued by a Controller to a
Processor, and directing the same to perform a specific or general action with regard to
Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making
available).
"Permitted Affiliates" means any of your Affiliates that (i) are permitted to use theSubscription Services pursuant to the Agreement, but have not signed their own
separate agreement with us and are not a “Customer” as defined under the Agreement,(ii) qualify as a Controller of Personal Data Processed by us, and (iii) are subject toEuropean Data Protection Laws.
“Personal Data” means any information relating to an identified or identifiable individual
where (i) such information is contained within Customer Data; and (ii) is protectedsimilarly as personal data, personal information or personally identifiable information
under applicable Data Protection Laws.
3

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2“Personal Data Breach” means a breach of security leading to the accidental or unlawfuldestruction, loss, alteration, unauthorized disclosure of, or access to, Personal Datatransmitted, stored or otherwise Processed by us and/or our Sub-Processors inconnection with the provision of the Subscription Services. "Personal Data Breach" will
not include unsuccessful attempts or activities that do not compromise the security of
Personal Data, including unsuccessful log-in attempts, pings, port scans, denial ofservice attacks, and other network attacks on firewalls or networked systems.
“Processing” means any operation or set of operations which is performed on Personal
Data, encompassing the collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction or
erasure of Personal Data. The terms “Process”, “Processes” and “Processed” will be
construed accordingly.
“Processor” means a natural or legal person, public authority, agency or other bodywhich Processes Personal Data on behalf of the Controller.
“Standard Contractual Clauses” means the standard contractual clauses annexed to theEuropean Commission’s Decision (EU) 2021/914 of 4 June 2021 currently found athttps://eur-lex.europa.eu/eli/dec_impl/2021/914/, as may be amended, superseded or
replaced.
“Sub-Processor” means any Processor engaged by us or our Affiliates to assist in
fulfilling our obligations with respect to the provision of the Subscription Services underthe Agreement. Sub-Processors may include third parties or our Affiliates but will
exclude any HubSpot employee or consultant.
“UK Addendum” means the International Data Transfer Addendum issued by the UK
Information Commissioner under section 119A(1) of the Data Protection Act 2018
currently found at https://ico.org.uk/media/fororganisations/documents/4019539/international-data-transfer-addendum.pdf, as may beamended, superseded, or replaced.
2. Customer Responsibilities
a. Compliance with Laws. Within the scope of the Agreement and in its use of theservices, you will be responsible for complying with all requirements that apply to it
under applicable Data Protection Laws with respect to its Processing of Personal Dataand the Instructions it issues to us.
In particular but without prejudice to the generality of the foregoing, you acknowledge
and agree that you will be solely responsible for: (i) the accuracy, quality, and legality ofCustomer Data and the means by which you acquired Personal Data; (ii) complying withall necessary transparency and lawfulness requirements under applicable Data
4

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Protection Laws for the collection and use of the Personal Data, including obtaining any
necessary consents and authorizations (particularly for use by Customer for marketing
purposes); (iii) ensuring you have the right to transfer, or provide access to, thePersonal Data to us for Processing in accordance with the terms of the Agreement(including this DPA); (iv) ensuring that your Instructions to us regarding the Processingof Personal Data comply with applicable laws, including Data Protection Laws; and (v)complying with all laws (including Data Protection Laws) applicable to any emails orother content created, sent or managed through the Subscription Services, including
those relating to obtaining consents (where required) to send emails, the content of theemails and its email deployment practices. You will inform us without undue delay if you
are not able to comply with your responsibilities under this 'Compliance with Laws'
section or applicable Data Protection Laws.
b. Controller Instructions. The parties agree that the Agreement (including this DPA),
together with your use of the Subscription Service in accordance with the Agreement,
constitute your complete Instructions to us in relation to the Processing of Personal
Data, so long as you may provide additional instructions during the Subscription Termthat are consistent with the Agreement, the nature and lawful use of the Subscription
Service.
c. Security. You are responsible for independently determining whether the data
security provided for in the Subscription Service adequately meets your obligations
under applicable Data Protection Laws. You are also responsible for your secure use of
the Subscription Service, including protecting the security of Personal Data in transit toand from the Subscription Service (including to securely backup or encrypt any such
Personal Data).
3. HubSpot Obligations
a. Compliance with Instructions. We will only Process Personal Data for the purposes
described in this DPA or as otherwise agreed within the scope of your lawful
Instructions, except where and to the extent otherwise required by applicable law. We
are not responsible for compliance with any Data Protection Laws applicable to you or
your industry that are not generally applicable to us.
b. Conflict of Laws. If we become aware that we cannot Process Personal Data inaccordance with your Instructions due to a legal requirement under any applicable law,
we will (i) promptly notify you of that legal requirement to the extent permitted by theapplicable law; and (ii) where necessary, cease all Processing (other than merely
storing and maintaining the security of the affected Personal Data) until such time as
you issue new Instructions with which we are able to comply. If this provision is invoked,
we will not be liable to you under the Agreement for any failure to perform the applicable
Subscription Services until such time as you issue new lawful Instructions with regard to
the Processing.

5DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

c. Security. We will implement and maintain appropriate technical and organizational
measures to protect Personal Data from Personal Data Breaches, as described under
Annex 2 to this DPA ("Security Measures"). Notwithstanding any provision to thecontrary, we may modify or update the Security Measures at our discretion provided
that such modification or update does not result in a material degradation in theprotection offered by the Security Measures.
d. Confidentiality. We will ensure that any personnel whom we authorize to Process
Personal Data on our behalf is subject to appropriate confidentiality obligations (whether
a contractual or statutory duty) with respect to that Personal Data.
e. Personal Data Breaches. We will notify you without undue delay after we becomeaware of any Personal Data Breach and will provide timely information relating to the
Personal Data Breach as it becomes known or reasonably requested by you. At yourrequest, we will promptly provide you with such reasonable assistance as necessary toenable you to notify relevant Personal Data Breaches to competent authorities and/or
affected Data Subjects, if you are required to do so under Data Protection Laws.
f. Deletion or Return of Personal Data. We will delete or return all Customer Data,
including Personal Data (including copies thereof) Processed pursuant to this DPA, on
termination or expiration of your Subscription Service in accordance with the procedures
set out in our Product Specific Terms. This term will apply except where we are requiredby applicable law to retain some or all of the Customer Data, or where we have archived
Customer Data on back-up systems, which data we will securely isolate and protectfrom any further Processing and delete in accordance with our deletion practices. You
may request the deletion of your HubSpot account after expiration or termination of yoursubscription by sending a request using our privacy request form at
https://preferences.hubspot.com/privacy.
We strongly recommend retrieving your Customer Data prior to the end of yourSubscription Term by following the instructions at the following knowledge base articles:"Export your Content and Data"; "Export your Records"; "Export your Ad PerformanceData"; "Export your Marketing Email Performance Data"; "Perform a permanent deletein HubSpot.
If you need help retrieving your Customer Data during the Subscription Term, we will
provide reasonable assistance to you, at your cost, and in accordance with the‘Confidentiality’ section of the General Terms.
4. Data Subject Requests
The Subscription Service provides you with a number of controls that you can use to
retrieve, correct, delete or restrict Personal Data, which you can use to assist it inconnection with its obligations under Data Protection Laws, including your obligations

6

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

relating to responding to requests from Data Subjects to exercise their rights underapplicable Data Protection Laws ("Data Subject Requests").
To the extent that you are unable to independently address a Data Subject Request
through the Subscription Service, then upon your written request we will provide
reasonable assistance to you to respond to any Data Subject Requests or requests
from data protection authorities relating to the Processing of Personal Data under the
Agreement. You will reimburse us for the commercially reasonable costs arising fromthis assistance.
If a Data Subject Request or other communication regarding the Processing of Personal
Data under the Agreement is made directly to us, we will promptly inform you and willadvise the Data Subject to submit their request to you. You will be solely responsible forresponding substantively to any such Data Subject Requests or communications
involving Personal Data.
5. Sub-Processors
You agree we may engage Sub-Processors to Process Personal Data on your behalf,
and we do so in three ways. First, we may engage Sub-Processors to assist us withhosting and infrastructure. Second, we may engage with Sub-Processors to support
product features and integrations. Third, we may engage with HubSpot Affiliates as
Sub-Processors for service and support. Some Sub-Processors will apply to you as
default, and some Sub-Processors will apply only if you opt-in.
We have currently appointed, as Sub-Processors, the third parties and HubSpot
Affiliates listed in Annex 3 to this DPA. You may subscribe to receive notifications byemail if we add or replace any Sub-Processors by completing the form available athttps://legal.hubspot.com/subscribe-subprocessor-updates. If you opt-in to receive such
email, we will notify you at least 30 days prior to any such change.
We will give you the opportunity to object to the engagement of new Sub-Processors on
reasonable grounds relating to the protection of Personal Data within 30 days of
notifying you. If you do notify us of such an objection, the parties will discuss yourconcerns in good faith with a view to achieving a commercially reasonable resolution. If
no such resolution can be reached, we will, at our sole discretion, either not appoint the
new Sub-Processor, or permit you to suspend or terminate the affected Subscription
Service in accordance with the termination provisions of the Agreement without liability
to either party (but without prejudice to any fees incurred by you prior to suspension or
termination).
Where we engage Sub-Processors, we will impose data protection terms on the SubProcessors that provide at least the same level of protection for Personal Data as thosein this DPA, to the extent applicable to the nature of the services provided by such SubProcessors. We will remain responsible for each Sub-Processor’s compliance with the7DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

obligations of this DPA and for any acts or omissions of such Sub-Processor that cause
us to breach any of its obligations under this DPA.
6. Data Transfers
You acknowledge and agree that we may access and Process Personal Data on a
global basis as necessary to provide the Subscription Service in accordance with theAgreement, and in particular that Personal Data may be transferred to and Processedby HubSpot, Inc. in the United States and to other jurisdictions where HubSpot Affiliates
and Sub-Processors have operations. Wherever Personal Data is transferred outside its
country of origin, each party will ensure such transfers are made in compliance with therequirements of Data Protection Laws.
7. Demonstration of Compliance
We will make all information reasonably necessary to demonstrate compliance with this
DPA available to you and allow for and contribute to audits, including inspections
conducted by you or your auditor in order to assess compliance with this DPA, whererequired by applicable law. You acknowledge and agree that you will exercise your audit
rights under this DPA by instructing us to comply with the audit measures described inthis 'Demonstration of Compliance' section. You acknowledge that the Subscription
Service is hosted by our hosting Sub-Processors who maintain independently validated
security programs (including SOC 2 and ISO 27001) and that our systems are audited
annually as part of SOC 2 compliance and regularly tested by independent third party
penetration testing firms. Upon request, we will supply (on a confidential basis) our SOC
2 report and summary copies of our penetration testing report(s) to you so that you canverify our compliance with this DPA. You may download copies of these documentsfrom HubSpot’s Security website at trust.hubspot.com. Further, at your written request,
we will provide written responses (on a confidential basis) to all reasonable requests for
information made by you necessary to confirm our compliance with this DPA, provided
that you will not exercise this right more than once per calendar year unless you havereasonable grounds to suspect non-compliance with the DPA.
8. Additional Provisions for European Dataa. Scope. This 'Additional Provisions for European Data' section will apply only withrespect to European Data.
b. Roles of the Parties. When Processing European Data in accordance with your
Instructions, the parties acknowledge and agree that you are acting as the Controller ofEuropean Data (either as the Controller, or as a Processor on behalf of another
Controller) and we are the Processor under the Agreement.
c. Instructions. If we believe that your Instruction infringes European Data Protection
Laws (where applicable), we will inform you without delay.
8DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

d. Data Protection Impact Assessments and Consultation with Supervisory Authorities.
To the extent that the required information is reasonably available to us, and you do not
otherwise have access to the required information, we will provide reasonableassistance to you with any data protection impact assessments, and prior consultations
with supervisory authorities (for example, the French Data Protection Agency (CNIL),
the Berlin Data Protection Authority (BlnBDI) and the UK Information Commissioner's
Office (ICO)) or other competent data privacy authorities to the extent required by
European Data Protection Laws.
e. Transfer Mechanisms for Data Transfers.
(A) HubSpot will not transfer European Data to any country or recipient not recognizedas providing an adequate level of protection for Personal Data (within the meaning of
applicable European Data Protection Laws), unless it first takes all such measures as
are necessary to ensure the transfer is in compliance with applicable European Data
Protection Laws. Such measures may include (without limitation) (i) transferring suchdata to a recipient that is covered by a suitable framework or other legally adequatetransfer mechanism recognized by the relevant authorities or courts as providing anadequate level of protection for Personal Data, including the Data Privacy Framework;(ii) to a recipient that has achieved binding corporate rules authorization in accordancewith European Data Protection Laws; or (iii) to a recipient that has executed theStandard Contractual Clauses; in each case as adopted or approved in accordance withapplicable European Data Protection Laws.
(B) You acknowledge that in connection with the performance of the Subscription
Services, HubSpot, Inc. is a recipient of European Data in the United States. To theextent that HubSpot, Inc. receives European Data in the United States, HubSpot, Inc.
will comply with the following:(1) Data Privacy Framework. HubSpot, Inc. will use the Data Privacy Framework
to lawfully receive European Data in the United States and ensure that it provides
at least the same level of protection to such European Data as is required by the
Data Privacy Framework Principles and will let you know if it is unable to comply
with this requirement.
(2) Standard Contractual Clauses. If European Data Protection Laws require thatappropriate safeguards are put in place (for example, if the Data Privacy
Framework does not cover the transfer to HubSpot, Inc. and/or the Data Privacy
Framework is invalidated), the Standard Contractual Clauses will be incorporated
by reference and form part of the Agreement as follows:(a) In relation to European Data that is subject to the GDPR (i) Customer
is the "data exporter" and HubSpot, Inc. is the "data importer"; (ii) the
Module Two terms apply to the extent the Customer is a Controller ofEuropean Data and the Module Three terms apply to the extent the9DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Customer is a Processor of European Data; (iii) in Clause 7, the optional
docking clause applies; (iv) in Clause 9, Option 2 applies and changes to
Sub-Processors will be notified in accordance with the ‘Sub-Processors’
section of this DPA; (v) in Clause 11, the optional language is deleted; (vi)in Clauses 17 and 18, the parties agree that the governing law and forum
for disputes for the Standard Contractual Clauses will be determined inaccordance with the 'Contracting Entity; Applicable Law; Notice’ section of
the Jurisdiction Specific Terms or, if such section does not specify an EU
Member State, the Republic of Ireland (without reference to conflicts oflaw principles); (vii) the Annexes of the Standard Contractual Clauses will
be deemed completed with the information set out in the Annexes of this
DPA; (viii) the supervisory authority that will act as competent supervisory
authority will be determined in accordance with GDPR; and (ix) if and to
the extent the Standard Contractual Clauses conflict with any provision ofthis DPA the Standard Contractual Clauses will prevail to the extent ofsuch conflict.
(b) In relation to European Data that is subject to the UK GDPR, theStandard Contractual Clauses will apply in accordance with sub-section(a) and the following modifications (i) the Standard Contractual Clauses
will be modified and interpreted in accordance with the UK Addendum,
which will be incorporated by reference and form an integral part of theAgreement; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemedcompleted with the information set out in the Annexes of this DPA and
Table 4 will be deemed completed by selecting “neither party”; and (iii) any
conflict between the terms of the Standard Contractual Clauses and the
UK Addendum will be resolved in accordance with Section 10 and Section
11 of the UK Addendum.
(c) In relation to European Data that is subject to the Swiss DPA, theStandard Contractual Clauses will apply in accordance with sub-section(a) and the following modifications (i) references to "Regulation (EU)2016/679" will be interpreted as references to the Swiss DPA; (ii)references to "EU", "Union" and "Member State law" will be interpreted as
references to Swiss law; and (iii) references to the "competent supervisory
authority" and "competent courts" will be replaced with the "the Swiss
Federal Data Protection and Information Commissioner " and the "relevant
courts in Switzerland".
(d) You agree that by complying with our obligations under the 'Sub-Processors'section of this DPA, HubSpot, Inc. fulfills its obligations under Section 9 of theStandard Contractual Clauses. For the purposes of Clause 9(c) of the Standard
Contractual Clauses, you acknowledge that we may be restricted from disclosing
Sub-Processor agreements but we will use reasonable efforts to require any
Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement

10DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

to you and will provide (on a confidential basis) all information we reasonably
can. You also acknowledge and agree that you will exercise your audit rights
under Clause 8.9 of the Standard Contractual Clauses by instructing us tocomply with the measures described in the 'Demonstration of Compliance'
section of this DPA.

(e) Where the HubSpot contracting entity under the Agreement is not
HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully
and solely responsible and liable to you for the performance of theStandard Contractual Clauses by HubSpot, Inc., and you will direct any
instructions, claims or enquiries in relation to the Standard Contractual
Clauses to such contracting entity. If HubSpot cannot comply with its
obligations under the Standard Contractual Clauses or is breach of any
warranties under the Standard Contractual Clauses or UK Addendum (asapplicable) for any reason, and you intend to suspend the transfer ofEuropean Data to HubSpot or terminate the Standard Contractual Clauses,or UK Addendum, you agree to provide us with reasonable notice toenable us to cure such non-compliance and reasonably cooperate with us
to identify what additional safeguards, if any, may be implemented to
remedy such non-compliance. If we have not or cannot cure the noncompliance, you may suspend or terminate the affected part of the
Subscription Service in accordance with the Agreement without liability toeither party (but without prejudice to any fees you have incurred prior tosuch suspension or termination).
(C) Alternative Transfer Mechanism. In the event that HubSpot is required to adopt analternative transfer mechanism for European Data, in addition to or other than themechanisms described in sub-section (B) above, such alternative transfer mechanism
will apply automatically instead of the mechanisms described in this DPA (but only tothe extent such alternative transfer mechanism complies with European Data ProtectionLaws), and you agree to execute such other documents or take such action as may bereasonably necessary to give legal effect such alternative transfer mechanism.
9. Additional Provisions for California Personal Informationa. Scope. The 'Additional Provisions for California Personal Information' section of the
DPA will apply only with respect to California Personal Information.
b. Roles of the Parties. When processing California Personal Information in accordancewith your Instructions, the parties acknowledge and agree that you are a Business and
we are a Service Provider for the purposes of the CCPA.
c. Responsibilities. We certify that we will Process California Personal Information as aService Provider strictly for the purpose of performing the Subscription Services andConsulting Services under the Agreement (the "Business Purpose") or as otherwise11DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

permitted by the CCPA, including as described in the 'Usage Data' section of ourPrivacy Policy.
Further, we certify we i) will not Sell or Share California Personal Information; (ii) will not
Process California Personal Information outside the direct business relationshipbetween the parties, unless required by applicable law; and (iii) will not combine theCalifornia Personal Information included in Customer Data with personal informationthat we collect or receive from another source (other than information we receive fromanother source in connection with our obligations as a Service Provider under the
Agreement).
d. Compliance. We will (i) comply with obligations applicable to us as a Service Provider
under the CCPA and (ii) provide California Personal Information with the same level ofprivacy protection as is required by the CCPA. We will notify you if we make adetermination that we can no longer meet our obligations as a Service Provider under
the CCPA.
e. CCPA Audits. You will have the right to take reasonable and appropriate steps tohelp ensure that we use California Personal Information in a manner consistent with
Customer’s obligations under the CCPA. Upon notice, you will have the right to takereasonable and appropriate steps in accordance with the Agreement to stop andremediate unauthorized use of California Personal Information.
f. Not a Sale. The parties acknowledge and agree that the disclosure of California
Personal Information by the Customer to HubSpot does not form part of any monetaryor other valuable consideration exchanged between the parties.
10. General Provisions
a. Amendments. Notwithstanding anything else to the contrary in the Agreement andwithout prejudice to the ‘Compliance with Instructions’ or ‘Security’ sections of this DPA,
we reserve the right to make any updates and changes to this DPA and the terms that
apply in the ‘Amendment; No Waiver’ section of the General Terms will apply.
b. Severability. If any individual provisions of this DPA are determined to be invalid or
unenforceable, the validity and enforceability of the other provisions of this DPA will not
be affected.
c. Limitation of Liability. Each party and each of their Affiliates' liability, taken inaggregate, arising out of or related to this DPA (including any other DPAs between theparties) and the Standard Contractual Clauses, where applicable, whether in contract,
tort or under any other theory of liability, will be subject to the limitations and exclusionsof liability set out in the 'Limitation of Liability' section of the General Terms and any
reference in such section to the liability of a party means aggregate liability of that party
and all of its Affiliates under the Agreement (including this DPA). For the avoidance of
12DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

doubt, if HubSpot, Inc. is not a party to the Agreement, the ‘Limitation of Liability’ sectionof the General Terms will apply as between you and HubSpot, Inc., and in such respect
any references to ‘HubSpot’, ‘we’, ‘us’ or ‘our’ will include both HubSpot, Inc. and the
HubSpot entity that is a party to the Agreement. In no event will either party's liability belimited with respect to any individual's data protection rights under this DPA (including
any other data processing agreements between the parties and the Standard
Contractual Clauses, where applicable) or otherwise.
d. Governing Law. This DPA will be governed by and construed in accordance with the‘Contracting Entity; ‘Applicable Law; Notice’ sections of the Jurisdiction Specific Terms,
unless required otherwise by Data Protection Laws.
11. Parties to this DPA
a. Permitted Affiliates. By signing the Agreement, you enter into this DPA (including,where applicable, the Standard Contractual Clauses) on behalf of yourself and in thename and on behalf of your Permitted Affiliates. For the purposes of this DPA only, andexcept where indicated otherwise, the terms “Customer”, “you” and “your” will include
you and such Permitted Affiliates.
b. Authorization. The legal entity agreeing to this DPA as Customer represents that it isauthorized to agree to and enter into this DPA for and on behalf of itself and, asapplicable, each of its Permitted Affiliates.
c. Remedies. The parties agree that (i) solely the Customer entity that is the contracting
party to the Agreement will exercise any right or seek any remedy any Permitted
Affiliate may have under this DPA on behalf of its Affiliates, and (ii) the Customer entitythat is the contracting party to the Agreement will exercise any such rights under thisDPA not separately for each Permitted Affiliate individually but in a combined manner
for itself and all of its Permitted Affiliates together. The Customer entity that is thecontracting entity is responsible for coordinating all Instructions, authorizations andcommunications with us under the DPA and will be entitled to make and receive any
communications related to this DPA on behalf of its Permitted Affiliates.
d. Other rights. The parties agree that you will, when reviewing our compliance with thisDPA pursuant to the ‘Demonstration of Compliance’ section, take all reasonablemeasures to limit any impact on us and our Affiliates by combining several audit
requests carried out on behalf of the Customer entity that is the contracting party to theAgreement and all of its Permitted Affiliates in one single audit.

13

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2EXECUTED BY THE PARTIES AUTHORIZED REPRESENTATIVES:
HubSpot, Inc., by and on behalf of its
affiliates, as applicable.

Controller: _______________________

Signature: ________________________

Signature: ________________________

Name: Nicholas Knoop

Name: ___________________________

Title: Data Protection Officer

Title: ____________________________

Either as a Controller, or as a Processor acting in
the capacity of a Controller, on behalf of another
Controller.

Date: ____________________________

14

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Annex 1 - Details of Processing
A. List of Parties
Data exporter:
Name: The Customer, as defined in the HubSpot Customer Terms of Service (on behalfof itself and Permitted Affiliates)
Address: The Customer's address, as set out in the Order FormContact person’s name, position and contact details: The Customer's contact details, as
set out in the Order Form and/or as set out in the Customer’s HubSpot AccountActivities relevant to the data transferred under these Clauses: Processing of Personal
Data in connection with Customer's use of the HubSpot Subscription Services under the
HubSpot Customer Terms of Service
Role (controller/processor): Controller (either as the Controller; or acting in the capacityof a Controller, as a Processor, on behalf of another Controller)
Data importer:
Name: HubSpot, Inc.
Address: Two Canal Park, Cambridge, MA 02141, USA
Contact person’s name, position and contact details: Nicholas Knoop, Data Protection
Officer, HubSpot, Inc., Two Canal Park, Cambridge, MA 02141 USA
Activities relevant to the data transferred under these Clauses: Processing of Personal
Data in connection with Customer's use of the HubSpot Subscription Services under the
HubSpot Customer Terms of Service
Role (controller/processor): Processor
B. Description of Transfer
Categories of Data Subjects whose Personal Data is Transferred
You may submit Personal Data in the course of using the Subscription Service, theextent of which is determined and controlled by you in your sole discretion, and which
may include, but is not limited to Personal Data relating to the following categories ofData Subjects:

15DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Your Contacts and other end users including your employees, contractors,
collaborators, customers, prospects, suppliers and subcontractors. Data Subjects may
also include individuals attempting to communicate with or transfer Personal Data to
your end users.
Categories of Personal Data Transferred
You may submit Personal Data to the Subscription Services, the extent of which isdetermined and controlled by you in your sole discretion, and which may include but is
not limited to the following categories of Personal Data:
1. Contact Information (as defined in the General Terms).
2. Any other Personal Data submitted by, sent to, or received by you, or your end
users, via the Subscription Service.
Sensitive Data transferred and applied restrictions or safeguards
The processing of Sensitive Data is subject to the scope limitations, restrictions, andsafeguards mutually agreed upon by the parties, as reflected in the Agreement.
Frequency of the transfer
Continuous
Nature of the Processing
Personal Data will be Processed in accordance with the Agreement (including this DPA)
and may be subject to the following Processing activities:
1. Storage and other Processing necessary to provide, maintain and improve theSubscription Services provided to you; and/or
2. Disclosure in accordance with the Agreement (including this DPA) and/or ascompelled by applicable laws.
Purpose of the transfer and further processing
We will Process Personal Data as necessary to provide the Subscription Services
pursuant to the Agreement, as further specified in the Order Form, and as further
instructed by you in your use of the Subscription Services.
Period for which Personal Data will be retained16DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Subject to the 'Deletion or Return of Personal Data' section of this DPA, we will Process
Personal Data for the duration of the Agreement, unless otherwise agreed in writing.

17

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Annex 2 - Security Measures
We currently observe the Security Measures described in this Annex 2. All capitalized
terms not otherwise defined herein will have the meanings as set forth in the General
Terms. For more information on these security measures, please refer to HubSpot’s
SOC 2 Type II Report, SOC 3 Report, Security Overview and Penetration Test
Summaries, available at trust.hubspot.com.
a) Information Security Policy.
We maintain and adhere to an internal, written Information Security Policy. You canvisit the HubSpot Trust Center, which provides an overview of our security standards.
b) Access Controli) Preventing Unauthorized Product AccessOutsourced processing: We host our Service with outsourced cloud infrastructure
providers. Additionally, we maintain contractual relationships with vendors in order toprovide the Service in accordance with our DPA. We rely on contractual agreements,
privacy policies, and vendor compliance programs in order to protect data processed orstored by these vendors.
Physical and environmental security: We host our product infrastructure with multitenant, outsourced infrastructure providers. We do not own or maintain hardware
located at the outsourced infrastructure providers’ data centers. Production servers andclient-facing applications are logically and physically secured from our internal corporate
information systems. The infrastructure providers’ physical and environmental security
controls are audited for SOC 2 Type II and ISO 27001 compliance, among othercertifications.
Authentication: We implement a uniform password policy for our customer products.
Customers who interact with the products via the user interface must authenticate
before accessing non-public customer data.
Authorization: Customer Data is stored in multi-tenant storage systems accessible to
Customers via only application user interfaces and application programming interfaces.
Customers are not allowed direct access to the underlying application infrastructure.
The authorization model in each of our products is designed to ensure that only theappropriately assigned individuals can access relevant features, views, andcustomization options. Authorization to data sets is performed through validating theuser’s permissions against the attributes associated with each data set.
Application Programming Interface (API) access: Public product APIs may be accessedusing Oauth authorization or private app tokens.

18DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2ii) Preventing Unauthorized Product Use
We implement industry standard access controls and detection capabilities for theinternal networks that support its products.
Access controls: Network access control mechanisms are designed to prevent network
traffic using unauthorized protocols from reaching the product infrastructure. The
technical measures implemented differ between infrastructure providers and include
Virtual Private Cloud (VPC) implementations, security group assignment, and traditional
firewall rules.
Intrusion detection and prevention: We implement a Web Application Firewall (WAF)
solution to protect hosted customer websites and other internet-accessible applications.
The WAF is designed to identify and prevent attacks against publicly available network
services.
Static code analysis: Code stored in our source code repositories is checked for bestpractices and identifiable software flaws using automated tooling.
Endpoint Harding: Endpoints are hardened in accordance with industry standardpractice. Workstations are protected using anti-malware and endpoint detection &response tools, receiving regular definition and signature updates.
iii)

Limitations of Privilege & Authorization Requirements

Privileged Access Management: Privileged access in our product environment is
controlled, monitored, and removed in a timely fashion through “just in time access” (or“JITA”) controls. Non-personal accounts used for system access are stored in a securevault with additional controls governing privilege elevation and account check out
processes.
Product access: A subset of our employees have access to the products and to
customer data via controlled interfaces. The intent of providing access to a subset of
employees is to provide effective customer support, product development and research,
to troubleshoot potential problems, to detect and respond to security incidents andimplement data security. Access is enabled through JITA requests for access; all such
requests are logged. Employees are granted access by role, and reviews of high risk
privilege grants are initiated daily. Administrative or high risk access permissions arereviewed at least once every six months.
c) Transmission Control
In-transit: We require HTTPS encryption (also referred to as SSL or TLS) on all login
interfaces and for free on every customer site hosted on the HubSpot products. Our
HTTPS implementation uses industry standard algorithms and certificates.

19DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

At-rest: We store user passwords following policies that follow industry standardpractices for security. We take a layered approach of at-rest encryption technologies toensure Customer data and Customer-identified Permitted Sensitive Data areappropriately encrypted.
d) Incident Management, Logging, and Monitoring
Incident Response Plan: We maintain a written Incident Response Plan, playbooks, andother necessary processes and procedures to fulfill the standards and obligations
reflected therein.
Detection: We designed our infrastructure to log extensive information about the systembehavior, traffic received, system authentication, and other application requests. Internal
systems aggregate log data and alert appropriate employees of malicious, unintended,or anomalous activities. Our personnel, including security, operations, and support
personnel, are responsive to known incidents.
Response and tracking: We maintain a record of known security incidents that includes
description, dates and times of relevant activities, and incident disposition. Suspected
and confirmed security incidents are investigated by security, operations, or support
personnel; and appropriate resolution steps are identified and documented. For any
confirmed incidents, we will take appropriate steps to minimize product and Customer
damage or unauthorized disclosure. Notification to you will be in accordance with theterms of the Agreement.
e) Availability Control
Infrastructure availability: The infrastructure providers use commercially reasonable
efforts to ensure a minimum of 99.95% uptime. The providers maintain a minimum of
N+1 redundancy to power, network, and heating, ventilation and air conditioning(HVAC) services.
Fault tolerance: Backup and replication strategies are designed to ensure redundancy
and fail-over protections during a significant processing failure. Customer data isbacked up to multiple durable data stores and replicated across multiple availability
zones.
Online replicas and backups: Where feasible, production databases are designed toreplicate data between no less than 1 primary and 1 secondary instance. All databases
are backed up and maintained using at least industry standard methods.
Disaster Recovery Plans: We maintain and regularly test disaster recovery plans to help
ensure availability of information following interruption to, or failure of, critical businessprocesses.

20DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Our products are designed to ensure redundancy and seamless failover. The server
instances that support the products are also architected with a goal to prevent single
points of failure. This design assists our operations in maintaining and updating the
product applications and backend while limiting downtime.
f) Vulnerability Management Program
Vulnerability Remediation Schedule: We maintain a vulnerability remediation schedulealigned with industry standards. We take a risk-based approach to determining avulnerability’s applicability, likelihood, and impact in our environment.
Vulnerability scanning: We perform daily vulnerability scanning on our products using
technology and detection standards aligned with industry standards.
Penetration testing: We maintain relationships with industry-recognized penetration
testing service providers for penetration testing of both the HubSpot web applicationand internal corporate network infrastructure at least annually. The intent of thesepenetration tests is to identify security vulnerabilities and mitigate the risk and business
impact they pose to the in-scope systems.
Bug bounty: A bug bounty program invites and incentivizes independent security
researchers to ethically discover and disclose security flaws. We implement a bug
bounty program in an effort to widen the available opportunities to engage with thesecurity community and improve the product defenses against sophisticated attacks.
g) Personnel Management
We staff qualified personnel to develop, maintain, and enhance our security program.
We train all employees on security policy, processes, and standards relevant to theirrole and in accordance with industry practice.
Background checks: Where permitted by applicable law, HubSpot employees undergo athird-party background or reference check. In the United States, employment offers arecontingent upon the results of a third-party background check. All HubSpot employees
are required to conduct themselves in a manner consistent with company guidelines,
non-disclosure requirements, and ethical standards.

21

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Annex 3 - Sub-Processors
Last Modified: June 4, 2024
This Annex 3 is incorporated into the DPA and Agreement. This annex explains how
HubSpot engages with Sub-Processors.
1. Infrastructure Sub-Processors
2. Feature Specific Sub-Processors
3. HubSpot Affiliate Sub-Processors
4. Updates to Sub-Processors
Please review each section for additional details.
1. Infrastructure Sub-Processors
To help HubSpot deliver the Subscription Service, we engage Sub-Processors to
support our infrastructure. By agreeing to the DPA, you agree all of these SubProcessors may have access to Customer Data.

Third
Party
SubProcessor Purpose

AmazonWeb
Services,Inc.

Hosting &Infrastructure

Cloudflare, Content Delivery
Inc.
Network

Applicable
Service

US Data Center
Sub-Processor
Location:
United States

EU Data Center
Sub-Processor
Location: EU or
Other

Used as a ondemand cloudcomputingplatforms andAPIs

United States

Germany

Used as a web
infrastructure andwebsite security,
providing content
delivery network
services, DDoS
mitigation,internet security, United Statesand distributed

Local**Data Centers
located all
around the world.
Traffic will be
automaticallyrouted to the22DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

domain nameserver services

Google
LLC

Infrastructure- Regional Data
Processing

Snowflake,
Inc.
Infrastructurenearest data
center.

Data hosting
providerUnited States

Germany

Data warehousesolution which
serves as therepository ofdata.

United States

Germany**For further information regarding Cloudflare services,
visit https://www.cloudflare.com/network/.

2. Feature Specific Sub-Processors
Some of our features and integrations require the use of additional Sub-Processors.
Some Sub-Processors will apply to you as a default, and some Sub-Processors will
apply to you only if and when you opt-in. We will notify you before you turn on a feature
or install an integration that requires support from an opt-in Sub-Processor whereindicated in the table below.

Third Party
SubProcessor Purpose

Applicable
Service

US DataCenter SubProcessor
Location:
United States

EU DataCenter SubProcessor
Location: EUor Other23DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Ably Realtime Ltd.

Conversation &ChatFunctionality

Used to support
conversations/chatfeatures in the
HubSpot product United States

Used for files anddocuments
conversion forwebsites andConvertAPI,
web/desktop
UAB
File Functionality applications

United States

Ireland andGermany

Germany

Use of Google
reCAPTCHA isdisabled by default
and is an opt-in
feature within theforms tool. If you
do not choose to
use Google
Form
reCAPTCHA, no
submission
Customer Data
spam prevention will be accessed(Googleby this SubreCAPTCHA)
Processor.
Use of Google
reCAPTCHA isenabled by default
without an opt-out
feature within B2B
Checkout. If you
do not wish to use
GooglereCAPTCHA,
payments should
not be submitted
B2B Checkoutwith B2B
Google LLC spam prevention Checkout.
United States*United States24DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

DropboxSign(formerly
HelloSign)

LitmusSoftware,Inc.

E-Signature
Functionality

Used for HubSpot
product Esignature solution
for deals
United States

Germany

EmailFunctionality

Used for emailpreviews

United States*United States

Used to support
the connection ofyour WhatsApp
Business accountto theconversations
inbox.

OPT-INONLY

Conversation
Functionality

Use of WhatsApp
is an opt-in
integration. If you
do not install the
WhatsAppintegration, no
Customer Data
will be shared.

United States*United States

Mux, Inc.

Video
Functionality

Used for HubSpot
video service
providerUnited States*United States

Meta
Platforms,
Inc.

25

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2OpenAI,LLC

AI Products

Used for HubSpot
AI Products tools United States*United States

Stripe, Inc.

Payment
Processor

Used to support
Commerce Hub
products andservices

United States

United States

Twilio, Inc.

Used to support
HubSpot calling
Calling and SMS and SMS
Functionality
functionality

United States*United States*You may choose not to use the functionality provided by our Sub-Processors marked
with an asterisk above. Please see the HubSpot Regional Data Hosting Policy available
at https://legal.hubspot.com/hubspot-regional-data-hosting-policy for further information.

3. HubSpot Affiliate Sub-Processors
To help HubSpot deliver the Subscription Service, we engage HubSpot Affiliates as
Sub-Processors to assist with our data processing activities. By agreeing to the DPA,
you agree all of these Sub-Processors may have access to Customer Data.

HubSpot Sub-Processor

PurposeLocation

HubSpot, Inc.

Services & Support

United States

26

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

HubSpot Ireland Ltd

Services & Support

Ireland

HubSpot Germany GmbH

Services & Support

Germany

HubSpot Australia Pty. Ltd.

Services & Support

Australia

HubSpot Asia Pte. Ltd.

Services & Support

Singapore

HubSpot Japan KK

Services & Support

Japan

HubSpot Latin America,
S.A.S.

Services & Support

Colombia

HubSpot Sweden

Services & Support

SwedenHubSpot France S.A.S.

Services & Support

FranceHubSpot UK Holdings Ltd.

Services & Support

United Kingdom

Services & Support

Belgium

HubSpot Canada Inc.

Services & Support

CanadaHubSpot Spain, S.L.

Services & Support

Spain

HubSpot Belgium NV

27

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

HubSpot Netherlands B.V.

Services & Support

The Netherlands

4. Updates to this Page
Due to the nature of our global business and our ongoing efforts to delight ourcustomers, our business needs and services providers may change from time to time.
For example, we may deprecate a service provider to consolidate and minimize our useof service providers. Similarly, we may add a service provider if we believe that doing so
will enhance our ability to deliver our Subscription Service.
You may subscribe to receive notifications by email if we update this page to add or
replace any Sub-Processors, if any of our Sub-Processors materially change theservices that they provide, or if they change the country from which they provide them.
To subscribe please complete the form available at https://legal.hubspot.com/subscribesubprocessor-updates. If you opt-in to receive such email, we will notify you at least 30
days prior to any such change.
For more information on HubSpot’s privacy practices, please visit our Privacy Policy. If
you have any questions regarding this page, please contact us at
privacy@hubspot.com.
On behalf of the data exporter:
Name (written out in full): …
Position: …
Address: …
Other information necessary in order for the contract to be binding (if any):
Signature …

On behalf of the data importer:
Name (written out in full): Nicholas Knoop
Position: VP, Privacy, Risk & Compliance
Address: Two Canal Park, Cambridge, MA 02492 U.S.A.
Other information necessary in order for the contract to be binding (if any):28

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2Signature …

29

DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Appendix 1 to the Standard Contractual ClausesThis Appendix forms part of the Standard Contractual Clauses (the 'Clauses').
This Appendix forms part of the Standard Contractual Clauses. A description of the
Details of Processing, including (i) List of Parties, (ii) Description of the Transfer and (iii)Competent Supervisory Authority are set out in Annex 1 of the DPA.
DATA EXPORTER
Name: …
Authorised Signature …
DATA IMPORTER
Name: Nicholas Knoop, Data Protection Officer
Authorised Signature30DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Appendix 2 to the Standard Contractual ClausesThis Appendix forms part of the Standard Contractual Clauses (the 'Clauses').
A description of the technical and organisational security measures implemented by thedata importer in accordance with Standard Contractual Clauses are set out in Annex 2of the DPA.
DATA EXPORTER
Name: …
Authorised Signature …
DATA IMPORTER
Name: Nicholas Knoop, Data Protection Officer
Authorised Signature31DocuSign Envelope ID: 6B0F8A46-FCB7-428F-B693-75ECDA54B8D2

Appendix 3 to the Standard Contractual ClausesThis Appendix forms part of the Standard Contractual Clauses (the 'Clauses').
The List of Sub-Processors used by the data importer are listed in accordance with
Clause 9(a) of the Standard Contractual Clauses are set out in Annex 2 of the DPA:

Name: …
Authorised Signature …
DATA IMPORTER
Name: Nicholas Knoop, Data Protection Officer
Authorised Signature

32DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

Official Journal of the European Union

L 199/31

COMMISSION IMPLEMENTING DECISION (EU) 2021/914
of 4 June 2021
on standard contractual clauses for the transfer of personal data to third countries pursuant toRegulation (EU) 2016/679 of the European Parliament and of the Council(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on theprotection of natural persons with regard to the processing of personal data and on the free movement of such data, andrepealing Directive 95/46/EC (General Data Protection Regulation) (1), and in particular Article 28(7) and Article 46(2)(c)thereof,
Whereas:(1)

Technological developments are facilitating cross-border data flows necessary for the expansion of international
cooperation and international trade. At the same time, it is necessary to ensure that the level of protection ofnatural persons guaranteed by Regulation (EU) 2016/679 is not undermined where personal data is transferred tothird countries, including in cases of onward transfers (2). The data transfer provisions in Chapter V of Regulation(EU) 2016/679 are intended to ensure the continuity of that high level of protection where personal data istransferred to a third country (3).

(2)

Pursuant to Article 46(1) of Regulation (EU) 2016/679, in the absence of an adequacy decision by the Commission
pursuant to Article 45(3), a controller or processor may transfer personal data to a third country only if it has
provided appropriate safeguards, and on condition that enforceable rights and effective legal remedies for data
subjects are available. Such safeguards may be provided for by standard data protection clauses adopted by theCommission pursuant to Article 46(2)(c).

(3)

The role of standard contractual clauses is limited to ensuring appropriate data protection safeguards forinternational data transfers. Therefore, the controller or processor transferring the personal data to a third country(the ‘data exporter’) and the controller or processor receiving the personal data (the ‘data importer’) are free toinclude those standard contractual clauses in a wider contract and to add other clauses or additional safeguards,
provided that they do not contradict, directly or indirectly, the standard contractual clauses or prejudice thefundamental rights or freedoms of data subjects. Controllers and processors are encouraged to provide additionalsafeguards by means of contractual commitments that supplement the standard contractual clauses (4). The use of
the standard contractual clauses is without prejudice to any contractual obligations of the data exporter and/or
importer to ensure respect for applicable privileges and immunities.

(4)

Beyond using standard contractual clauses to provide appropriate safeguards for transfers pursuant to Article 46(1)of Regulation (EU) 2016/679, the data exporter has to fulfil its general responsibilities as controller or processor
under Regulation (EU) 2016/679. Those responsibilities include an obligation of the controller to provide data
subjects with information about the fact that it intends to transfer their personal data to a third country pursuant to
Article 13(1)(f) and Article 14(1)(f) of Regulation (EU) 2016/679. In the case of transfers pursuant to Article 46 ofRegulation (EU) 2016/679, such information must include a reference to the appropriate safeguards and the meansby which to obtain a copy of them or information where they have been made available.

(1) OJ L 119, 4.5.2016, p. 1.
(2) Article 44 of Regulation (EU) 2016/679.
(3) See also judgment of the Court of Justice of 16 July 2020 in Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd andMaximillian Schrems (‘Schrems II’), ECLI:EU:C:2020:559, paragraph 93.
(4) Recital 109 of Regulation (EU) 2016/679.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/32

EN

Official Journal of the European Union

7.6.2021(5)

Commission Decisions 2001/497/EC (5) and 2010/87/EU (6) contain standard contractual clauses to facilitate thetransfer of personal data from a data controller established in the Union to a controller or processor established in athird country that does not offer an adequate level of protection. Those decisions were based on Directive 95/46/EC
of the European Parliament and of the Council (7).

(6)

Pursuant to Article 46(5) of Regulation (EU) 2016/679, Decision 2001/497/EC and Decision 2010/87/EU remain inforce until amended, replaced or repealed, if necessary, by a Commission decision adopted pursuant to Article 46(2)of that Regulation. The standard contractual clauses in the decisions required updating in the light of new
requirements in Regulation (EU) 2016/679. Moreover, since the decisions were adopted, the digital economy has
seen significant developments, with the widespread use of new and more complex processing operations often
involving multiple data importers and exporters, long and complex processing chains, and evolving business
relationships. This calls for modernisation of the standard contractual clauses to reflect those realities better, bycovering additional processing and transfer situations, and to allow a more flexible approach, for example withrespect to the number of parties able to join the contract.

(7)

A controller or processor may use the standard contractual clauses set out in the Annex to this Decision to provide
appropriate safeguards within the meaning of Article 46(1) of Regulation (EU) 2016/679 for the transfer of
personal data to a processor or controller established in a third country, without prejudice to the interpretation of
the notion of international transfer in Regulation (EU) 2016/679. The standard contractual clauses may be used forsuch transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU)2016/679. This also includes the transfer of personal data by a controller or processor not established in the Union,
to the extent that the processing is subject to Regulation (EU) 2016/679 (pursuant to Article 3(2) thereof), because it
relates to the offering of goods or services to data subjects in the Union or the monitoring of their behaviour as far as
it takes place within the Union.

(8)

Given the general alignment of Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 of the European
Parliament and of the Council (8), it should be possible to use the standard contractual clauses also in the context ofa contract, as referred to in Article 29(4) of Regulation (EU) 2018/1725 for the transfer of personal data to a subprocessor in a third country by a processor that is not a Union institution or body, but which is subject toRegulation (EU) 2016/679 and which processes personal data on behalf of a Union institution or body inaccordance with Article 29 of Regulation (EU) 2018/1725. Provided the contract reflects the same data protection
obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article
29(3) Regulation (EU) 2018/1725, in particular by providing sufficient guarantees for technical and organisational
measures to ensure that the processing meets the requirements of that Regulation, this will ensure compliance with
Article 29(4) of Regulation (EU) 2018/1725. In particular, that will be the case where the controller and processor
use the standard contractual clauses in Commission Implementing Decision on standard contractual clauses
between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliamentand of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of theCouncil (9).

(9)

Where the processing involves data transfers from controllers subject to Regulation (EU) 2016/679 to processors
outside its territorial scope or from processors subject to Regulation (EU) 2016/679 to sub-processors outside its
territorial scope, the standard contractual clauses set out in the Annex to this Decision should also allow to fulfil therequirements of Article 28(3) and (4) of Regulation (EU) 2016/679.

(10)

The standard contractual clauses set out in the Annex to this Decision combine general clauses with a modular
approach to cater for various transfer scenarios and the complexity of modern processing chains. In addition to thegeneral clauses, controllers and processors should select the module applicable to their situation, so as to tailor their
obligations under the standard contractual clauses to their role and responsibilities in relation to the data processing(5) Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third
countries, under Directive 95/46/EC (OJ L 181, 4.7.2001, p. 19).
(6) Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors
established in third countries under Directive 95/46/EC of the European Parliament and of the Council (OJ L 39, 12.2.2010, p. 5).
(7) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to
the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).
(8) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons
with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement ofsuch data and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39); see recital 5.
(9) C(2021) 3701.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/33

in question. It should be possible for more than two parties to adhere to the standard contractual clauses. Moreover,additional controllers and processors should be allowed to accede to the standard contractual clauses as data
exporters or importers throughout the lifecycle of the contract of which they form a part.

(11)

In order to provide appropriate safeguards, the standard contractual clauses should ensure that the personal datatransferred on that basis is afforded a level of protection essentially equivalent to that guaranteed within theUnion (10). With a view to ensuring transparency of processing, data subjects should be provided with a copy of thestandard contractual clauses and be informed, in particular, of the categories of personal data processed, the right toobtain a copy of the standard contractual clauses, and any onward transfer. Onward transfers by the data importer toa third party in another third country should be allowed only if the third party accedes to the standard contractual
clauses, if the continuity of protection is ensured otherwise, or in specific situations, such as on the basis of the
explicit, informed consent of the data subject.

(12)

With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between
the data exporter and data importer, data subjects should be able to invoke, and where necessary enforce, thestandard contractual clauses as third-party beneficiaries. Therefore, while the parties should be allowed to choose
the law of one of the Member States as governing the standard contractual clauses, that law must allow for thirdparty beneficiary rights. In order to facilitate individual redress, the standard contractual clauses should require thedata importer to inform data subjects of a contact point and to deal promptly with any complaints or requests. In
the event of a dispute between the data importer and a data subject who invokes his or her rights as a third-party
beneficiary, the data subject should be able to lodge a complaint with the competent supervisory authority or refer
the dispute to the competent courts in the EU.

(13)

In order to ensure effective enforcement, the data importer should be required to submit to the jurisdiction of such
authority and courts, and to commit to abide by any binding decision under the applicable Member State law. In
particular, the data importer should agree to respond to enquiries, submit to audits and comply with the measures
adopted by the supervisory authority, including remedial and compensatory measures. In addition, the data
importer should have the option of offering data subjects the opportunity to seek redress before an independent
dispute resolution body, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should beallowed to be represented by associations or other bodies in disputes against the data importer if they so wish.

(14)

The standard contractual clauses should provide for rules on liability between the parties and with respect to data
subjects, and rules on indemnification between the parties. Where the data subject suffers material or non-material
damage as a consequence of any breach of the third-party beneficiary rights under the standard contractual clauses,
he or she should be entitled to compensation. This should be without prejudice to any liability under Regulation (EU)2016/679.

(15)

In the case of a transfer to a data importer acting as a processor or sub-processor, specific requirements should applyin accordance with Article 28(3) of Regulation (EU) 2016/679. The standard contractual clauses should require thedata importer to make available all information necessary to demonstrate compliance with the obligations set out inthe clauses and to allow for and contribute to audits of its processing activities by the data exporter. With respect tothe engagement of any sub-processor by the data importer, in line with Article 28(2) and (4) of Regulation (EU)2016/679, the standard contractual clauses should in particular set out the procedure for general or specificauthorisation from the data exporter and the requirement for a written contract with the sub-processor ensuring
the same level of protection as under the clauses.

(16)

It is appropriate to provide different safeguards in the standard contractual clauses that cover the specific situation ofa transfer of personal data by a processor in the Union to its controller in a third country and reflect the limited selfstanding obligations for processors under Regulation (EU) 2016/679. In particular, the standard contractual clausesshould require the processor to inform the controller if it is unable to follow its instructions, including if such
instructions infringe Union data protection law, and require the controller to refrain from any actions that would
prevent the processor from fulfilling its obligations under Regulation (EU) 2016/679. They should also require theparties to assist each other in responding to enquiries and requests from data subjects under the local law applicable(10) Schrems II, paragraphs 96 and 103. See also Regulation (EU) 2016/679, recitals 108 and 114.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

L 199/34

Official Journal of the European Union

7.6.2021

to the data importer or, for data processing in the Union, under Regulation (EU) 2016/679. Additional requirements
to address any effects of the laws of the third country of destination on the controller’s compliance with the clauses,
in particular how to deal with binding requests from public authorities in the third country for disclosure of thetransferred personal data, should apply where the Union processor combines the personal data received from thecontroller in the third country with personal data collected by the processor in the Union. Conversely, no suchrequirements are justified where the outsourcing merely involves the processing and transfer back of personal datathat has been received from the controller and in any event has been and will remain subject to the jurisdiction of
the third country in question.

(17)

The parties should be able to demonstrate compliance with the standard contractual clauses. In particular, the data
importer should be required to keep appropriate documentation for the processing activities under its responsibility
and to inform the data exporter promptly if it is unable to comply with the clauses, for whatever reason. In turn, thedata exporter should suspend the transfer and, in particularly serious cases, have the right to terminate the contract,
insofar as it concerns the processing of personal data under standard contractual clauses, where the data importer isin breach of the clauses or unable to comply with them. Specific rules should apply where local laws affectcompliance with the clauses. Personal data that has been transferred prior to the termination of the contract, andany copies thereof, should at the choice of the data exporter be returned to the data exporter or destroyed in their
entirety.

(18)

The standard contractual clauses should provide for specific safeguards, in particular in the light of the case law of
the Court of Justice (11), to address any effects of the laws of the third country of destination on the data importer’s
compliance with the clauses, in particular how to deal with binding requests from public authorities in that country
for disclosure of the transferred personal data.

(19)

The transfer and processing of personal data under standard contractual clauses should not take place if the laws andpractices of the third country of destination prevent the data importer from complying with the clauses. In thiscontext, laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed whatis necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) ofRegulation (EU) 2016/679 should not be considered as being in conflict with the standard contractual clauses. The
parties should warrant that, at the time of agreeing to the standard contractual clauses, they have no reason tobelieve that the laws and practices applicable to the data importer are not in line with these requirements.

(20)

The parties should take account, in particular, of the specific circumstances of the transfer (such as the content andduration of the contract, the nature of the data to be transferred, the type of recipient, the purpose of theprocessing), the laws and practices of the third country of destination that are relevant in light of the circumstancesof the transfer and any safeguards put in place to supplement those under the standard contractual clauses(including relevant contractual, technical and organisational measures applying to the transmission of personal dataand its processing in the country of destination). As regards the impact of such laws and practices on compliancewith the standard contractual clauses, different elements may be considered as part of an overall assessment,
including reliable information on the application of the law in practice (such as case law and reports byindependent oversight bodies), the existence or absence of requests in the same sector and, under strict conditions,the documented practical experience of the data exporter and/or data importer.

(21)

The data importer should notify the data exporter if, after agreeing to the standard contractual clauses, it has reason
to believe that it is not able to comply with the standard contractual clauses. If the data exporter receives such
notification or otherwise becomes aware that the data importer is no longer able to comply with the standard
contractual clauses, it should identify appropriate measures to address the situation, if necessary in consultation
with the competent supervisory authority. Such measures may include supplementary measures adopted by thedata exporter and/or data importer, such as technical or organisational measures to ensure security andconfidentiality. The data exporter should be required to suspend the transfer if it considers that no appropriate
safeguards can be ensured, or if so instructed by the competent supervisory authority.

(11) Schrems II.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/35(22)

Where possible, the data importer should notify the data exporter and the data subject if it receives a legally binding
request from a public (including judicial) authority under the law of the country of destination for disclosure of
personal data transferred pursuant to the standard contractual clauses. Similarly, it should notify them if it becomesaware of any direct access by public authorities to such personal data, in accordance with the law of the third
country of destination. If, despite its best efforts, the data importer is not in a position to notify the data exporter
and/or the data subject of specific disclosure requests, it should provide the data exporter with as much relevant
information as possible on the requests. In addition, the data importer should provide the data exporter withaggregate information at regular intervals. The data importer should also be required to document any request fordisclosure received and the response provided, and make that information available to the data exporter or thecompetent supervisory authority, or both, upon request. If, following a review of the legality of such a request under
the laws of the country of destination, the data importer concludes that there are reasonable grounds to consider
that the request is unlawful under the laws of the third country of destination, it should challenge it, including,where appropriate, by exhausting available possibilities of appeal. In any event, if the data importer is no longer
able to comply with the standard contractual clauses, it should inform the data exporter accordingly, including
where this is the consequence of a request for disclosure.

(23)

As stakeholder needs, technology and processing operations may change, the Commission should evaluate theoperation of the standard contractual clauses in the light of experience, as part of the periodic evaluation ofRegulation (EU) 2016/679 referred to in Article 97 of that Regulation.

(24)

Decision 2001/497/EC and Decision 2010/87/EU should be repealed three months after the entry into force of thisDecision. During that period, data exporters and data importers should, for the purpose of Article 46(1) ofRegulation (EU) 2016/679, still be able to use the standard contractual clauses set out in Decisions 2001/497/EC
and 2010/87/EU. For an additional period of 15 months, data exporters and data importers should, for the purposeof Article 46(1) of Regulation (EU) 2016/679, be able to continue to rely on standard contractual clauses set out in
Decisions 2001/497/EC and 2010/87/EU for the performance of contracts concluded between them before the dateof repeal of those decisions, provided that the processing operations that are the subject matter of the contract
remain unchanged and that reliance on the clauses ensures that the transfer of personal data is subject toappropriate safeguards within the meaning of Article 46(1) of Regulation (EU) 2016/679. In the event of relevantchanges to the contract, the data exporter should be required to rely on a new ground for data transfers under thecontract, in particular by replacing the existing standard contractual clauses with the standard contractual clauses
set out in the Annex to this Decision. The same should apply to any sub-contracting to a (sub-)processor ofprocessing operations covered by the contract.

(25)

The European Data Protection Supervisor and the European Data Protection Board were consulted in accordancewith Article 42(1) and (2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 14 January 2021 (12),which has been taken into consideration in the preparation of this Decision.

(26)

The measures provided for in this Decision are in accordance with the opinion of the Committee established under
Article 93 of Regulation (EU) 2016/679,

HAS ADOPTED THIS DECISION:

Article 1
1.
The standard contractual clauses set out in the Annex are considered to provide appropriate safeguards within themeaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for the transfer by a controller or processor of personal
data processed subject to that Regulation (data exporter) to a controller or (sub-)processor whose processing of the data is
not subject to that Regulation (data importer).
2.
The standard contractual clauses also set out the rights and obligations of controllers and processors with respect tothe matters referred to in Article 28(3) and (4) of Regulation (EU) 2016/679, as regards the transfer of personal data froma controller to a processor, or from a processor to a sub-processor.
(12) EDPB EDPS Joint Opinion 2/2021 on the European Commission’s Implementing Decision on standard contractual clauses for thetransfer of personal data to third countries for the matters referred to in Article 46(2)(c) of Regulation (EU) 2016/679.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/36

EN

Official Journal of the European Union

7.6.2021

Article 2
Where the competent Member State authorities exercise corrective powers pursuant to Article 58 of Regulation (EU)2016/679 in response to the data importer being or becoming subject to laws or practices in the third country ofdestination that prevent it from complying with the standard contractual clauses set out in the Annex, leading to thesuspension or ban of data transfers to third countries, the Member State concerned shall, without delay, inform theCommission, which will forward the information to the other Member States.
Article 3
The Commission shall evaluate the practical application of the standard contractual clauses set out in the Annex on thebasis of all available information, as part of the periodic evaluation required by Article 97 of Regulation (EU) 2016/679.
Article 41.
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of theEuropean Union.
2.

Decision 2001/497/EC is repealed with effect from 27 September 2021.

3.

Decision 2010/87/EU is repealed with effect from 27 September 2021.

4.
Contracts concluded before 27 September 2021 on the basis of Decision 2001/497/EC or Decision 2010/87/EU shallbe deemed to provide appropriate safeguards within the meaning of Article 46(1) of Regulation (EU) 2016/679 until
27 December 2022, provided the processing operations that are the subject matter of the contract remain unchanged andthat reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards.

Done at Brussels, 4 June 2021.

For the Commission
The President
Ursula VON DER LEYEN

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

Official Journal of the European Union

L 199/37

ANNEX

STANDARD CONTRACTUAL CLAUSESSECTION I

Clause 1
Purpose and scope(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons withregard to the processing of personal data and on the free movement of such data (General Data Protection
Regulation) (1) for the transfer of personal data to a third country.
(b) The Parties:(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring
the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via anotherentity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’)have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2
Effect and invariability of the Clauses(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies,pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers fromcontrollers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) ofRegulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or
update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses
laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they
do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU)2016/679.

Clause 3
Third-party beneficiaries(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data
importer, with the following exceptions:(i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;(1) Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as
controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also
ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices andagencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC(OJ L 295, 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal
act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will inparticular be the case where the controller and processor rely on the standard contractual clauses included in Decision 2021/915.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

L 199/38

Official Journal of the European Union

7.6.2021(ii)

Clause 8 – Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e);Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and
Clause 8.3(b);(iii)

Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);(iv)

Clause 12 – Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d) and (f);(v)

Clause 13;(vi)

Clause 15.1(c), (d) and (e);(vii) Clause 16(e);(viii) Clause 18 – Modules One, Two and Three: Clause 18(a) and (b); Module Four: Clause 18.
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4
Interpretation(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning
as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU)2016/679.

Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existingat the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for
which they are transferred, are specified in Annex I.B.

Clause 7 – Optional
Docking clause(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time,either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses
and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a
Party.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

Official Journal of the European Union

EN

7.6.2021

L 199/39

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through theimplementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

MODULE ONE: Transfer controller to controller
8.1

Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.
B. It may only process the personal data for another purpose:(i)where it has obtained the data subject’s prior consent;(ii) where necessary for the establishment, exercise or defence of legal claims in the context of specificadministrative, regulatory or judicial proceedings; or(iii) where necessary in order to protect the vital interests of the data subject or of another natural person.
8.2

Transparency(a) In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shallinform them, either directly or through the data exporter:(i)of its identity and contact details;(ii) of the categories of personal data processed;(iii) of the right to obtain a copy of these Clauses;(iv) where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories ofrecipients (as appropriate with a view to providing meaningful information), the purpose of such onward
transfer and the ground therefore pursuant to Clause 8.7.
(b) Paragraph (a) shall not apply where the data subject already has the information, including when suchinformation has already been provided by the data exporter, or providing the information proves impossible orwould involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to theextent possible, make the information publicly available.
(c) On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them,available to the data subject free of charge. To the extent necessary to protect business secrets or otherconfidential information, including personal data, the Parties may redact part of the text of the Appendix prior
to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able
to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with thereasons for the redactions, to the extent possible without revealing the redacted information.
(d) Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 ofRegulation (EU) 2016/679.
8.3

Accuracy and data minimisation(a) Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer
shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) ofprocessing, is erased or rectified without delay.
(b) If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has
become outdated, it shall inform the other Party without undue delay.
(c) The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in
relation to the purpose(s) of processing.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/40

8.4

EN

Official Journal of the European Union

7.6.2021

Storage limitation
The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it isprocessed. It shall put in place appropriate technical or organisational measures to ensure compliance with thisobligation, including erasure or anonymisation (2) of the data and all back-ups at the end of the retention period.

8.5

Security of processing(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical andorganisational measures to ensure the security of the personal data, including protection against a breach of
security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access(hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of
the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and therisks involved in the processing for the data subject. The Parties shall in particular consider having recourse to
encryption or pseudonymisation, including during transmission, where the purpose of processing can befulfilled in that manner.
(b) The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shallcarry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(c) The data importer shall ensure that persons authorised to process the personal data have committed themselvesto confidentiality or are under an appropriate statutory obligation of confidentiality.
(d) In the event of a personal data breach concerning personal data processed by the data importer under these
Clauses, the data importer shall take appropriate measures to address the personal data breach, including
measures to mitigate its possible adverse effects.
(e) In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, thedata importer shall without undue delay notify both the data exporter and the competent supervisory authority
pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including,where possible, categories and approximate number of data subjects and personal data records concerned), ii) its
likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact
point from whom more information can be obtained. To the extent it is not possible for the data importer toprovide all the information at the same time, it may do so in phases without undue further delay.
(f) In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural
persons, the data importer shall also notify without undue delay the data subjects concerned of the personal
data breach and its nature, if necessary in cooperation with the data exporter, together with the informationreferred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly
reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate
efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure
to inform the public of the personal data breach.
(g) The data importer shall document all relevant facts relating to the personal data breach, including its effects andany remedial action taken, and keep a record thereof.

8.6

Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious orphilosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely
identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating tocriminal convictions or offences (hereinafter ‘sensitive data’), the data importer shall apply specific restrictions
and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include
restricting the personnel permitted to access the personal data, additional security measures (such as
pseudonymisation) and/or additional restrictions with respect to further disclosure.

(2) This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26
of Regulation (EU) 2016/679, and that this process is irreversible.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

8.7

Official Journal of the European Union

L 199/41

Onward transfers
The data importer shall not disclose the personal data to a third party located outside the European Union (3) (in thesame country as the data importer or in another third country, hereinafter ‘onward transfer’) unless the third party isor agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data
importer may only take place if:(i)

it is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 thatcovers the onward transfer;(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU)2016/679 with respect to the processing in question;(iii) the third party enters into a binding instrument with the data importer ensuring the same level of dataprotection as under these Clauses, and the data importer provides a copy of these safeguards to the data
exporter;(iv) it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative,
regulatory or judicial proceedings;(v) it is necessary in order to protect the vital interests of the data subject or of another natural person; or(vi) where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject
for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of therecipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection
safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shalltransmit to it a copy of the information provided to the data subject.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses,
in particular purpose limitation.

8.8

Processing under the authority of the data importer
The data importer shall ensure that any person acting under its authority, including a processor, processes the data
only on its instructions.

8.9

Documentation and compliance(a) Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, thedata importer shall keep appropriate documentation of the processing activities carried out under its
responsibility.
(b) The data importer shall make such documentation available to the competent supervisory authority on request.

MODULE TWO: Transfer controller to processor
8.1

Instructions(a) The data importer shall process the personal data only on documented instructions from the data exporter. The
data exporter may give such instructions throughout the duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.

8.2

Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.
B, unless on further instructions from the data exporter.

(3) The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market
to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679,
is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to athird party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/42

8.3

EN

Official Journal of the European Union

7.6.2021

Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties,
available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential
information, including the measures described in Annex II and personal data, the data exporter may redact part of
the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where thedata subject would otherwise not be able to understand the its content or exercise his/her rights. On request, theParties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing theredacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13
and 14 of Regulation (EU) 2016/679.

8.4

Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it
shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data
exporter to erase or rectify the data.

8.5

Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of theprovision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal
data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to thedata exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or
returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicableto the data importer that prohibit return or deletion of the personal data, the data importer warrants that it willcontinue to ensure compliance with these Clauses and will only process it to the extent and for as long as required
under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer
under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that
it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).

8.6

Security of processing(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical andorganisational measures to ensure the security of the data, including protection against a breach of security
leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data
(hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due
account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) ofprocessing and the risks involved in the processing for the data subjects. The Parties shall in particular consider
having recourse to encryption or pseudonymisation, including during transmission, where the purpose ofprocessing can be fulfilled in that manner. In case of pseudonymisation, the additional information for
attributing the personal data to a specific data subject shall, where possible, remain under the exclusive controlof the data exporter. In complying with its obligations under this paragraph, the data importer shall at least
implement the technical and organisational measures specified in Annex II. The data importer shall carry out
regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly
necessary for the implementation, management and monitoring of the contract. It shall ensure that persons
authorised to process the personal data have committed themselves to confidentiality or are under anappropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these
Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate
its adverse effects. The data importer shall also notify the data exporter without undue delay after having becomeaware of the breach. Such notification shall contain the details of a contact point where more information can beobtained, a description of the nature of the breach (including, where possible, categories and approximate
number of data subjects and personal data records concerned), its likely consequences and the measures taken or
proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects.
Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shallcontain the information then available and further information shall, as it becomes available, subsequently beprovided without undue delay.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

Official Journal of the European Union

L 199/43(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its
obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and theaffected data subjects, taking into account the nature of processing and the information available to the data
importer.

8.7

Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious orphilosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely
identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating tocriminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions
and/or additional safeguards described in Annex I.B.

8.8

Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data
exporter. In addition, the data may only be disclosed to a third party located outside the European Union (4) (in thesame country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is oragrees to be bound by these Clauses, under the appropriate Module, or if:(i)the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation(EU) 2016/679 that covers the onward transfer;(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU)2016/679 with respect to the processing in question;(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context ofspecific administrative, regulatory or judicial proceedings; or(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural
person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses,
in particular purpose limitation.

8.9

Documentation and compliance(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to theprocessing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep
appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliancewith the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to auditsof the processing activities covered by these Clauses, at reasonable intervals or if there are indications of noncompliance. In deciding on a review or audit, the data exporter may take into account relevant certifications
held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may
include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be
carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits,available to the competent supervisory authority on request.

(4) The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market
to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679,
is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to athird party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/44

EN

Official Journal of the European Union

7.6.2021

MODULE THREE: Transfer processor to processor
8.1

Instructions(a) The data exporter has informed the data importer that it acts as processor under the instructions of its
controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as
communicated to the data importer by the data exporter, and any additional documented instructions from thedata exporter. Such additional instructions shall not conflict with the instructions from the controller. The
controller or data exporter may give further documented instructions regarding the data processing throughout
the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where
the data importer is unable to follow the instructions from the controller, the data exporter shall immediately
notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set
out in the contract or other legal act under Union or Member State law between the controller and the data
exporter (5).

8.2

Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.
B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, orfrom the data exporter.

8.3

Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties,
available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential
information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing
a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understandits content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the
redactions, to the extent possible without revealing the redacted information.

8.4

Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it
shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data
exporter to rectify or erase the data.

8.5

Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of theprovision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal
data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data
exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, thedata importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data
importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue toensure compliance with these Clauses and will only process it to the extent and for as long as required under that
local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has
become subject to laws or practices not in line with the requirements under Clause 14(a).

(5) See Article 28(4) of Regulation (EU) 2016/679 and, where the controller is an EU institution or body, Article 29(4) of Regulation (EU)2018/1725.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

8.6

Official Journal of the European Union

L 199/45

Security of processing(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical andorganisational measures to ensure the security of the data, including protection against a breach of security
leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data
(hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of
the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and therisks involved in the processing for the data subject. The Parties shall in particular consider having recourse to
encryption or pseudonymisation, including during transmission, where the purpose of processing can befulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal
data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter orthe controller. In complying with its obligations under this paragraph, the data importer shall at least implement
the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks
to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary
for the implementation, management and monitoring of the contract. It shall ensure that persons authorised toprocess the personal data have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these
Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate
its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, whereappropriate and feasible, the controller after having become aware of the breach. Such notification shall containthe details of a contact point where more information can be obtained, a description of the nature of the breach(including, where possible, categories and approximate number of data subjects and personal data records
concerned), its likely consequences and the measures taken or proposed to address the data breach, including
measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all
information at the same time, the initial notification shall contain the information then available and further
information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its
obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turnnotify the competent supervisory authority and the affected data subjects, taking into account the nature ofprocessing and the information available to the data importer.

8.7

Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious orphilosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely
identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating tocriminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions
and/or additional safeguards set out in Annex I.B.

8.8

Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from thecontroller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed toa third party located outside the European Union (6) (in the same country as the data importer or in another third
country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under theappropriate Module, or if:(i)the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation(EU) 2016/679 that covers the onward transfer;(6) The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market
to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679,
is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to athird party located in the EEA does not qualify as an onward transfer for the purposes of these Clauses.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/46

EN

Official Journal of the European Union

7.6.2021(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU)2016/679;(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context ofspecific administrative, regulatory or judicial proceedings; or(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural
person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses,
in particular purpose limitation.

8.9

Documentation and compliance(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that
relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep
appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out
in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities
covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shallapply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, thedata exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results
available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may
include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be
carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits,available to the competent supervisory authority on request.

MODULE FOUR: Transfer processor to controller

8.1

Instructions(a) The data exporter shall process the personal data only on documented instructions from the data importer acting
as its controller.
(b) The data exporter shall immediately inform the data importer if it is unable to follow those instructions,
including if such instructions infringe Regulation (EU) 2016/679 or other Union or Member State dataprotection law.
(c) The data importer shall refrain from any action that would prevent the data exporter from fulfilling its
obligations under Regulation (EU) 2016/679, including in the context of sub-processing or as regards
cooperation with competent supervisory authorities.
(d) After the end of the provision of the processing services, the data exporter shall, at the choice of the data
importer, delete all personal data processed on behalf of the data importer and certify to the data importer thatit has done so, or return to the data importer all personal data processed on its behalf and delete existing copies.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

8.2

EN

Official Journal of the European Union

L 199/47

Security of processing(a) The Parties shall implement appropriate technical and organisational measures to ensure the security of the data,
including during transmission, and protection against a breach of security leading to accidental or unlawfuldestruction, loss, alteration, unauthorised disclosure or access (hereinafter ‘personal data breach’). In assessing
the appropriate level of security, they shall take due account of the state of the art, the costs of implementation,
the nature of the personal data (7), the nature, scope, context and purpose(s) of processing and the risks involvedin the processing for the data subjects, and in particular consider having recourse to encryption or
pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in thatmanner.
(b) The data exporter shall assist the data importer in ensuring appropriate security of the data in accordance withparagraph (a). In case of a personal data breach concerning the personal data processed by the data exporter
under these Clauses, the data exporter shall notify the data importer without undue delay after becoming awareof it and assist the data importer in addressing the breach.
(c) The data exporter shall ensure that persons authorised to process the personal data have committed themselvesto confidentiality or are under an appropriate statutory obligation of confidentiality.

8.3

Documentation and compliance(a) The Parties shall be able to demonstrate compliance with these Clauses.
(b) The data exporter shall make available to the data importer all information necessary to demonstrate compliancewith its obligations under these Clauses and allow for and contribute to audits.

Clause 9
Use of sub-processors

MODULE TWO: Transfer controller to processor(a) OPTION 1: SPECIFIC PRIOR AUTHORISATION The data importer shall not sub-contract any of its processing
activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s
prior specific written authorisation. The data importer shall submit the request for specific authorisation at least[Specify time period] prior to the engagement of the sub-processor, together with the information necessary to enable
the data exporter to decide on the authorisation. The list of sub-processors already authorised by the data exporter canbe found in Annex III. The Parties shall keep Annex III up to date.
OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation
for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data
exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least[Specify time period] in advance, thereby giving the data exporter sufficient time to be able to object to such changes
prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with theinformation necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data
exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection
obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights
for data subjects. (8) The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under
Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data
importer is subject pursuant to these Clauses.
(7) This includes whether the transfer and further processing involves personal data revealing racial or ethnic origin, political opinions,religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying anatural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences.
(8) This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with
Clause 7.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/48

EN

Official Journal of the European Union

7.6.2021(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any
subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential
information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s
obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by
the sub-processor to fulfil its obligations under that contract.

(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data
importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have theright to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

MODULE THREE: Transfer processor to processor(a) OPTION 1: SPECIFIC PRIOR AUTHORISATION The data importer shall not sub-contract any of its processing
activities performed on behalf of the data exporter under these Clauses to a sub-processor without the prior specific
written authorisation of the controller. The data importer shall submit the request for specific authorisation at least[Specify time period] prior to the engagement of the sub-processor, together with the information necessary to enable
the controller to decide on the authorisation. It shall inform the data exporter of such engagement. The list of subprocessors already authorised by the controller can be found in Annex III. The Parties shall keep Annex III up to date.

OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the controller’s general authorisation for
the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller inwriting of any intended changes to that list through the addition or replacement of sub-processors at least [Specify time
period] in advance, thereby giving the controller sufficient time to be able to object to such changes prior to theengagement of the sub-processor(s). The data importer shall provide the controller with the information necessary toenable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagementof the sub-processor(s).

(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller),it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as thosebinding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. (9)The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data
importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject
pursuant to these Clauses.

(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement
and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information,
including personal data, the data importer may redact the text of the agreement prior to sharing a copy.

(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s
obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by
the sub-processor to fulfil its obligations under that contract.

(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data
importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have theright to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
(9) This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with
Clause 7.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

Official Journal of the European Union

L 199/49

Clause 10
Data subject rights

MODULE ONE: Transfer controller to controller(a) The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it
receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights underthese Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request. (10) The
data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject
rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear
and plain language.
(b) In particular, upon request by the data subject the data importer shall, free of charge:(i)

provide confirmation to the data subject as to whether personal data concerning him/her is being processed and,
where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has
been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate
with a view to providing meaningful information) to which the personal data has been or will be onward
transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide
information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);(ii) rectify inaccurate or incomplete data concerning the data subject;(iii) erase personal data concerning the data subject if such data is being or has been processed in violation of any ofthese Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which theprocessing is based.
(c) Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such
purposes if the data subject objects to it.
(d) The data importer shall not make a decision based solely on the automated processing of the personal data transferred(hereinafter ‘automated decision’), which would produce legal effects concerning the data subject or similarly
significantly affect him/her, unless with the explicit consent of the data subject or if authorised to do so under the lawsof the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights
and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:(i) inform the data subject about the envisaged automated decision, the envisaged consequences and the logic
involved; and(ii) implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point ofview and obtain review by a human being.
(e) Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer
may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act
on the request.
(f) The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country ofdestination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article
23(1) of Regulation (EU) 2016/679.
(g) If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for therefusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial
redress.

MODULE TWO: Transfer controller to processor(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not
respond to that request itself unless it has been authorised to do so by the data exporter.
(10) That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity andnumber of requests. The data importer shall duly and promptly inform the data subject of any such extension.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/50

EN

Official Journal of the European Union

7.6.2021(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the
exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II theappropriate technical and organisational measures, taking into account the nature of the processing, by which theassistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from thedata exporter.

MODULE THREE: Transfer processor to processor(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it hasreceived from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its
obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 orRegulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technicaland organisational measures, taking into account the nature of the processing, by which the assistance shall be
provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from thecontroller, as communicated by the data exporter.

MODULE FOUR: Transfer processor to controller
The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law
applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.

Clause 11
Redress(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice oron its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives
from a data subject.
[OPTION: The data importer agrees that data subjects may also lodge a complaint with an independent dispute
resolution body (11) at no cost to the data subject. It shall inform the data subjects, in the manner set out in paragraph(a), of such redress mechanism and that they are not required to use it, or follow a particular sequence in seeking
redress.]
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party
shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed
about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept thedecision of the data subject to:(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place ofwork, or the competent supervisory authority pursuant to Clause 13;(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(11) The data importer may offer independent dispute resolution through an arbitration body only if it is established in a country that has
ratified the New York Convention on Enforcement of Arbitration Awards.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/51(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under
the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and proceduralrights to seek remedies in accordance with applicable laws.

Clause 12
Liability
MODULE ONE: Transfer controller to controller
MODULE FOUR: Transfer processor to controller(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these
Clauses.
(b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any
material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights
under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these
Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action incourt against any of these Parties.
(d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the otherParty/ies that part of the compensation corresponding to its/their responsibility for the damage.
(e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these
Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, forany material or non-material damages the data importer or its sub-processor causes the data subject by breaching thethird-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled
to receive compensation, for any material or non-material damages the data exporter or the data importer (or its subprocessor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without
prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of acontroller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, asapplicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (orits sub-processor), it shall be entitled to claim back from the data importer that part of the compensation
corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these
Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action incourt against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the otherParty/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

L 199/52

Official Journal of the European Union

7.6.2021

Clause 13
Supervision
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility forensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in
Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of applicationof Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article
27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within
the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act ascompetent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of applicationof Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative
pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States inwhich the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods orservices to them, or whose behaviour is monitored, are located, as indicated in Annex I.C, shall act as competentsupervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority
in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respondto enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedialand compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary
actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIESClause 14
Local laws and practices affecting compliance with the Clauses
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
MODULE FOUR: Transfer processor to controller(where the EU processor combines the personal data received from the third
country-controller with personal data collected by the processor in the EU)(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination
applicable to the processing of the personal data by the data importer, including any requirements to disclose personal
data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations underthese Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental
rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard oneof the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of thefollowing elements:(i)the specific circumstances of the transfer, including the length of the processing chain, the number of actors
involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose ofprocessing; the categories and format of the transferred personal data; the economic sector in which the transfer
occurs; the storage location of the data transferred;DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/53(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to
public authorities or authorising access by such authorities – relevant in light of the specific circumstances of thetransfer, and the applicable limitations and safeguards (12);(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards underthese Clauses, including measures applied during transmission and to the processing of the personal data in the
country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts toprovide the data exporter with relevant information and agrees that it will continue to cooperate with the data
exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory
authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for theduration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line withthe requirements under paragraph (a), including following a change in the laws of the third country or a measure (suchas a disclosure request) indicating an application of such laws in practice that is not in line with the requirements inparagraph (a). [For Module Three: The data exporter shall forward the notification to the controller.](f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data
importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate
measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data
exporter and/or data importer to address the situation [for Module Three:, if appropriate in consultation with thecontroller]. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for suchtransfer can be ensured, or if instructed by [for Module Three: the controller or] the competent supervisory authority
to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processingof personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise thisright to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where thecontract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15

Obligations of the data importer in case of access by public authorities

MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
MODULE FOUR: Transfer processor to controller(where the EU processor combines the personal data received from the third
country-controller with personal data collected by the processor in the EU)(12) As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an
overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests fordisclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers inparticular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified
at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience isrelied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported byother relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficientweight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into
account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable
information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as caselaw and reports by independent oversight bodies.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/54

EN

Official Journal of the European Union

7.6.2021

15.1 Notification(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary
with the help of the data exporter) if it:(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of thecountry of destination for the disclosure of personal data transferred pursuant to these Clauses; such
notification shall include information about the personal data requested, the requesting authority, the legal
basis for the request and the response provided; or(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these
Clauses in accordance with the laws of the country of destination; such notification shall include all
information available to the importer.
[For Module Three: The data exporter shall forward the notification to the controller.](b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of thecountry of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, witha view to communicating as much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data
exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on
the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether
requests have been challenged and the outcome of such challenges, etc.). [For Module Three: The data exporter
shall forward the information to the controller.](d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of thecontract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and
Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains
within the powers granted to the requesting public authority, and to challenge the request if, after carefulassessment, it concludes that there are reasonable grounds to consider that the request is unlawful under thelaws of the country of destination, applicable obligations under international law and principles of internationalcomity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging arequest, the data importer shall seek interim measures with a view to suspending the effects of the request until
the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until
required to do so under the applicable procedural rules. These requirements are without prejudice to the
obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, tothe extent permissible under the laws of the country of destination, make the documentation available to the data
exporter. It shall also make it available to the competent supervisory authority on request. [For Module Three:
The data exporter shall make the assessment available to the controller.](c) The data importer agrees to provide the minimum amount of information permissible when responding to arequest for disclosure, based on a reasonable interpretation of the request.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

EN

7.6.2021

Official Journal of the European Union

L 199/55

SECTION IV – FINAL PROVISIONS

Clause 16
Non-compliance with the Clauses and termination(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whateverreason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data
exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or thecontract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data
under these Clauses, where:(i)the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) andcompliance with these Clauses is not restored within a reasonable time and in any event within one month ofsuspension;(ii) the data importer is in substantial or persistent breach of these Clauses; or(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding
its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority [for Module Three: and the controller] of such noncompliance. Where the contract involves more than two Parties, the data exporter may exercise this right totermination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) [For Modules One, Two and Three: Personal data that has been transferred prior to the termination of the contract
pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter ordeleted in its entirety. The same shall apply to any copies of the data.] [For Module Four: Personal data collected by thedata exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c)shall immediately be deleted in its entirety, including any copy thereof.] The data importer shall certify the deletion of
the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensurecompliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletionof the transferred personal data, the data importer warrants that it will continue to ensure compliance with these
Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a
decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to whichthese Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which thepersonal data is transferred. This is without prejudice to other obligations applying to the processing in question under
Regulation (EU) 2016/679.

Clause 17
Governing law
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor[OPTION 1: These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for thirdparty beneficiary rights. The Parties agree that this shall be the law of _______ (specify Member State).][OPTION 2 (for Modules Two and Three): These Clauses shall be governed by the law of the EU Member State in which thedata exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by thelaw of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be thelaw of _______ (specify Member State).]DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/56

EN

Official Journal of the European Union

7.6.2021

MODULE FOUR: Transfer processor to controller
These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that
this shall be the law of _______ (specify country).
Clause 18
Choice of forum and jurisdiction
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of _____ (specify Member State).
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of theMember State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
MODULE FOUR: Transfer processor to controller
Any dispute arising from these Clauses shall be resolved by the courts of _____ (specify country).

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/57

APPENDIXEXPLANATORY NOTE:
It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in thisregard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does notnecessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual
relationship, where this transparency can achieved through one appendix. However, where necessary to ensure sufficient
clarity, separate appendices should be used.

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/58

EN

Official Journal of the European Union

7.6.2021

ANNEX I

A. LIST OF PARTIESMODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
MODULE FOUR: Transfer processor to controller
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer
and/or representative in the European Union]
1. Name: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contact person’s name, position and contact details: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Activities relevant to the data transferred under these Clauses: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Signature and date: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Role (controller/processor): . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.

............................................................................................................................
Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for dataprotection]

1. Name: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contact person’s name, position and contact details: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Activities relevant to the data transferred under these Clauses: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Signature and date: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Role (controller/processor): . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.

............................................................................................................................

B. DESCRIPTION OF TRANSFER
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
MODULE FOUR: Transfer processor to controller
Categories of data subjects whose personal data is transferred............................................................................................................................
Categories of personal data transferred............................................................................................................................
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data
and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
............................................................................................................................
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
............................................................................................................................

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/59

Nature of the processing............................................................................................................................
Purpose(s) of the data transfer and further processing............................................................................................................................
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period............................................................................................................................
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing............................................................................................................................
C. COMPETENT SUPERVISORY AUTHORITY
MODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Identify the competent supervisory authority/ies in accordance with Clause 13............................................................................................................................

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

L 199/60

EN

Official Journal of the European Union

7.6.2021

ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL
MEASURES TO ENSURE THE SECURITY OF THE DATAMODULE ONE: Transfer controller to controller
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
EXPLANATORY NOTE:
The technical and organisational measures must be described in specific (and not generic) terms. See also the generalcomment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to eachtransfer/set of transfers.
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) toensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for therights and freedoms of natural persons.
[Examples of possible measures:
Measures of pseudonymisation and encryption of personal data
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of aphysical or technical incident
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order toensure the security of the processing
Measures for user identification and authorisation
Measures for the protection of data during transmission
Measures for the protection of data during storage
Measures for ensuring physical security of locations at which personal data are processed
Measures for ensuring events logging
Measures for ensuring system configuration, including default configuration
Measures for internal IT and IT security governance and management
Measures for certification/assurance of processes and products
Measures for ensuring data minimisation
Measures for ensuring data quality
Measures for ensuring limited data retention
Measures for ensuring accountability
Measures for allowing data portability and ensuring erasure]
For transfers to (sub-) processors, alsodescribe the specific technical and organisational measures to be taken by the (sub-)processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data
exporterDocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

7.6.2021

EN

Official Journal of the European Union

L 199/61

ANNEX III
LIST OF SUB-PROCESSORSMODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
EXPLANATORY NOTE:This Annex must be completed for Modules Two and Three, in case of the specific authorisation of sub-processors (Clause
9(a), Option 1).
The controller has authorised the use of the following sub-processors:
1. Name: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contact person’s name, position and contact details: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Description of processing (including a clear delimitation of responsibilities in case several sub-processors areauthorised): . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

Standard Data Protection Clauses to be issued by theCommissioner under S119A(1) Data Protection Act 2018
International Data Transfer Addendum to the EU Commission
Standard Contractual Clauses
VERSION B1.0, in force 21 March 2022

This Addendum has been issued by the Information Commissioner for Parties
making Restricted Transfers. The Information Commissioner considers that itprovides Appropriate Safeguards for Restricted Transfers when it is entered into
as a legally binding contract.

Part 1: Tables
Table 1: Parties
Start date

The Parties

Exporter (who sends the
Restricted Transfer)

Importer (who receives
the Restricted Transfer)

Parties’ details

Full legal name:

Full legal name:Trading name (if different):

Trading name (if different):

Main address (if a company
registered address):

Main address (if a company
registered address):

Official registration number(if any) (company number
or similar identifier):

Official registration number(if any) (company number orsimilar identifier):

VERSION B1.0, in force 21 March 20221DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Key Contact

Full Name (optional):

Full Name (optional):

Job Title:

Job Title:

Contact details including
email:

Contact details including
email:

Signature (ifrequired forthe purposesof Section 2)

Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU
SCCs

The version of the Approved EU SCCs which thisAddendum is appended to, detailed below, including the
Appendix Information:
Date:
Reference (if any):
Other identifier (if any):Or
the Approved EU SCCs, including the Appendix
Information and with only the following modules, clauses
or optional provisions of the Approved EU SCCs brought
into effect for the purposes of this Addendum:

Module Module in Clause 7
operation (Docking
Clause)Clause 11 Clause 9a Clause 9a Is personal data
(Option) (Prior(Time
received from
Authorisa period)
the Importertion orcombined with
Generalpersonal data
Authorisa
collected by thetion)
Exporter?

1
2
3
4

VERSION B1.0, in force 21 March 20222DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Table 3: Appendix Information“Appendix Information” means the information which must be provided forthe selected modules as set out in the Appendix of the Approved EU SCCs (otherthan the Parties), and which for this Addendum is set out in:
Annex 1A: List of Parties:
Annex 1B: Description of Transfer:
Annex II: Technical and organisational measures including technical andorganisational measures to ensure the security of the data:
Annex III: List of Sub processors (Modules 2 and 3 only):
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending thisAddendum
when theApproved
Addendumchanges

Which Parties may end this Addendum as set out in Section 19:
Importer
Exporterneither Party

Part 2: Mandatory Clauses
Entering into this Addendum
1.

Each Party agrees to be bound by the terms and conditions set out in thisAddendum, in exchange for the other Party also agreeing to be bound by
this Addendum.

2.

Although Annex 1A and Clause 7 of the Approved EU SCCs require signatureby the Parties, for the purpose of making Restricted Transfers, the Parties
may enter into this Addendum in any way that makes them legally bindingon the Parties and allows data subjects to enforce their rights as set out inthis Addendum. Entering into this Addendum will have the same effect assigning the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum
3.

Where this Addendum uses terms that are defined in the Approved EU SCCs
those terms shall have the same meaning as in the Approved EU SCCs. In
addition, the following terms have the following meanings:

VERSION B1.0, in force 21 March 20223

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

AddendumThis International Data Transfer Addendum which ismade up of this Addendum incorporating the Addendum
EU SCCs.

Addendum EU SCCs

The version(s) of the Approved EU SCCs which thisAddendum is appended to, as set out in Table 2,
including the Appendix Information.

Appendix
Information

As set out in Table 3.

Appropriate
Safeguards

The standard of protection over the personal data andof data subjects’ rights, which is required by UK Data
Protection Laws when you are making a RestrictedTransfer relying on standard data protection clauses
under Article 46(2)(d) UK GDPR.

Approved Addendum

The template Addendum issued by the ICO and laid
before Parliament in accordance with s119A of the Data
Protection Act 2018 on 2 February 2022, as it is revised
under Section 18.

Approved EU SCCs

The Standard Contractual Clauses set out in the Annex
of Commission Implementing Decision (EU) 2021/914
of 4 June 2021.

ICO

The Information Commissioner.

Restricted Transfer

A transfer which is covered by Chapter V of the UK
GDPR.

UK

The United Kingdom of Great Britain and Northern
Ireland.

UK Data Protection
Laws

All laws relating to data protection, the processing of
personal data, privacy and/or electronic
communications in force from time to time in the UK,

VERSION B1.0, in force 21 March 2022

4DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

including the UK GDPR and the Data Protection Act
2018.
UK GDPRAs defined in section 3 of the Data Protection Act 2018.

4.

This Addendum must always be interpreted in a manner that is consistent
with UK Data Protection Laws and so that it fulfils the Parties’ obligation toprovide the Appropriate Safeguards.

5.

If the provisions included in the Addendum EU SCCs amend the Approved
SCCs in any way which is not permitted under the Approved EU SCCs or the
Approved Addendum, such amendment(s) will not be incorporated in thisAddendum and the equivalent provision of the Approved EU SCCs will taketheir place.

6.

If there is any inconsistency or conflict between UK Data Protection Laws
and this Addendum, UK Data Protection Laws applies.

7.

If the meaning of this Addendum is unclear or there is more than one
meaning, the meaning which most closely aligns with UK Data Protection
Laws applies.

8.

Any references to legislation (or specific provisions of legislation) means thatlegislation (or specific provision) as it may change over time. This includes
where that legislation (or specific provision) has been consolidated, reenacted and/or replaced after this Addendum has been entered into.

Hierarchy
9.

Although Clause 5 of the Approved EU SCCs sets out that the Approved EU
SCCs prevail over all related agreements between the parties, the parties
agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.

10. Where there is any inconsistency or conflict between the Approved
Addendum and the Addendum EU SCCs (as applicable), the Approved
Addendum overrides the Addendum EU SCCs, except where (and in so faras) the inconsistent or conflicting terms of the Addendum EU SCCs provides
greater protection for data subjects, in which case those terms will override
the Approved Addendum.
11. Where this Addendum incorporates Addendum EU SCCs which have beenentered into to protect transfers subject to the General Data Protection
Regulation (EU) 2016/679 then the Parties acknowledge that nothing in thisAddendum impacts those Addendum EU SCCs.

VERSION B1.0, in force 21 March 20225

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Incorporation of and changes to the EU SCCs
12. This Addendum incorporates the Addendum EU SCCs which are amended tothe extent necessary so that:a. together they operate for data transfers made by the data exporter tothe data importer, to the extent that UK Data Protection Laws apply tothe data exporter’s processing when making that data transfer, andthey provide Appropriate Safeguards for those data transfers;
b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU
SCCs; andc. this Addendum (including the Addendum EU SCCs incorporated into it)is (1) governed by the laws of England and Wales and (2) any disputearising from it is resolved by the courts of England and Wales, in eachcase unless the laws and/or courts of Scotland or Northern Ireland havebeen expressly selected by the Parties.
13. Unless the Parties have agreed alternative amendments which meet therequirements of Section 12, the provisions of Section 15 will apply.
14. No amendments to the Approved EU SCCs other than to meet therequirements of Section 12 may be made.
15. The following amendments to the Addendum EU SCCs (for the purpose of
Section 12) are made:a. References to the “Clauses” means this Addendum, incorporating the
Addendum EU SCCs;
b. In Clause 2, delete the words:“and, with respect to data transfers from controllers to processors
and/or processors to processors, standard contractual clauses
pursuant to Article 28(7) of Regulation (EU) 2016/679”;
c. Clause 6 (Description of the transfer(s)) is replaced with:“The details of the transfers(s) and in particular the categories of
personal data that are transferred and the purpose(s) for which
they are transferred) are those specified in Annex I.B where UK
Data Protection Laws apply to the data exporter’s processing when
making that transfer.”;d. Clause 8.7(i) of Module 1 is replaced with:“it is to a country benefitting from adequacy regulations pursuant to
Section 17A of the UK GDPR that covers the onward transfer”;

VERSION B1.0, in force 21 March 2022

6

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

e. Clause 8.8(i) of Modules 2 and 3 is replaced with:“the onward transfer is to a country benefitting from adequacy
regulations pursuant to Section 17A of the UK GDPR that covers the
onward transfer;”f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of
the European Parliament and of the Council of 27 April 2016 on theprotection of natural persons with regard to the processing of personal
data and on the free movement of such data (General Data Protection
Regulation)” and “that Regulation” are all replaced by “UK Data
Protection Laws”. References to specific Article(s) of “Regulation (EU)2016/679” are replaced with the equivalent Article or Section of UK Data
Protection Laws;
g. References to Regulation (EU) 2018/1725 are removed;h. References to the “European Union”, “Union”, “EU”, “EU Member State”,“Member State” and “EU or Member State” are all replaced with the“UK”;
i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, isreplaced with “Clause 11(c)(i)”;j. Clause 13(a) and Part C of Annex I are not used;k. The “competent supervisory authority” and “supervisory authority” areboth replaced with the “Information Commissioner”;
l. In Clause 16(e), subsection (i) is replaced with:“the Secretary of State makes regulations pursuant to Section 17Aof the Data Protection Act 2018 that cover the transfer of personal
data to which these clauses apply;”;m. Clause 17 is replaced with:“These Clauses are governed by the laws of England and Wales.”;n. Clause 18 is replaced with:“Any dispute arising from these Clauses shall be resolved by the
courts of England and Wales. A data subject may also bring legal
proceedings against the data exporter and/or data importer before
the courts of any country in the UK. The Parties agree to submit
themselves to the jurisdiction of such courts.”; ando. The footnotes to the Approved EU SCCs do not form part of the
Addendum, except for footnotes 8, 9, 10 and 11.

VERSION B1.0, in force 21 March 2022

7

DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Amendments to this Addendum
16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU
SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
17. If the Parties wish to change the format of the information included in Part
1: Tables of the Approved Addendum, they may do so by agreeing to thechange in writing, provided that the change does not reduce the Appropriate
Safeguards.
18. From time to time, the ICO may issue a revised Approved Addendum which:a. makes reasonable and proportionate changes to the Approved
Addendum, including correcting errors in the Approved Addendum;
and/orb. reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which thechanges to the Approved Addendum are effective and whether the Parties
need to review this Addendum including the Appendix Information. This
Addendum is automatically amended as set out in the revised Approved
Addendum from the start date specified.
19. If the ICO issues a revised Approved Addendum under Section 18, if any
Party selected in Table 4 “Ending the Addendum when the Approved
Addendum changes”, will as a direct result of the changes in the Approved
Addendum have a substantial, disproportionate and demonstrable increasein:aits direct costs of performing its obligations under the Addendum;
and/orb

its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs orrisks so that it is not substantial and disproportionate, then that Party may
end this Addendum at the end of a reasonable notice period, by providing
written notice for that period to the other Party before the start date of therevised Approved Addendum.
20. The Parties do not need the consent of any third party to make changes tothis Addendum, but any changes must be made in accordance with its
terms.

VERSION B1.0, in force 21 March 20228DocuSign Envelope ID: F7C6C8CE-C2D3-4C77-8537-9EAA155EDB9A

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Alternative Part 2 Mandatory Clauses:
Mandatory
Clauses

Part 2: Mandatory Clauses of the Approved Addendum,
being the template Addendum B.1.0 issued by the ICO andlaid before Parliament in accordance with s119A of the Data
Protection Act 2018 on 2 February 2022, as it is revised
under Section 18 of those Mandatory Clauses.

VERSION B1.0, in force 21 March 20229