EUROPEAN
COMMISSION

Brussels, 4.6.2021
C(2021) 3972 final
ANNEX

ANNEX
to theCOMMISSION IMPLEMENTING DECISION
on standard contractual clauses for the transfer of personal data to third countries
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council

ANNEXSTANDARD CONTRACTUAL CLAUSESSECTION I
Clause 1
Purpose and scope(a)

The purpose of these standard contractual clauses is to ensure compliance with therequirements of Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data (General Data
Protection Regulation)1 for the transfer of personal data to a third country.

(b)

The Parties:(i)the natural or legal person(s), public authority/ies, agency/ies or other body/ies(hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A.
(hereinafter each “data exporter”), and(ii)

the entity/ies in a third country receiving the personal data from the data
exporter, directly or indirectly via another entity also Party to these Clauses, as
listed in Annex I.A. (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).
(c)

These Clauses apply with respect to the transfer of personal data as specified in
Annex I.B.

(d)

The Appendix to these Clauses containing the Annexes referred to therein forms an
integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses(a)1

These Clauses set out appropriate safeguards, including enforceable data subject
rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) ofRegulation (EU) 2016/679 and, with respect to data transfers from controllers toprocessors and/or processors to processors, standard contractual clauses pursuant to
Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except toselect the appropriate Module(s) or to add or update information in the Appendix.
Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union
institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing)not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU)2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural
persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies
and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No
1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection
obligations as set out in the contract or other legal act between the controller and the processor pursuant to
Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where thecontroller and processor rely on the standard contractual clauses included in Decision […].

1

This does not prevent the Parties from including the standard contractual clauses laid
down in these Clauses in a wider contract and/or to add other clauses or additionalsafeguards, provided that they do not contradict, directly or indirectly, these Clauses
or prejudice the fundamental rights or freedoms of data subjects.
(b)

These Clauses are without prejudice to obligations to which the data exporter issubject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries(a)Data subjects may invoke and enforce these Clauses, as third-party beneficiaries,
against the data exporter and/or data importer, with the following exceptions:(i)

Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;(ii)

Clause 8 - Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause
8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and
Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and Clause
8.3(b);(iii) Clause 9 - Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause
9(a), (c), (d) and (e);(iv) Clause 12 - Module One: Clause 12(a) and (d); Modules Two and Three:
Clause 12(a), (d) and (f);(v)

Clause 13;(vi) Clause 15.1(c), (d) and (e);(vii) Clause 16(e);(viii) Clause 18 - Modules One, Two and Three: Clause 18(a) and (b); Module Four:
Clause 18.
(b)

Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU)2016/679.
Clause 4
Interpretation(a)Where these Clauses use terms that are defined in Regulation (EU) 2016/679, thoseterms shall have the same meaning as in that Regulation.

(b)

These Clauses shall be read and interpreted in the light of the provisions ofRegulation (EU) 2016/679.

(c)

These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.

2Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements
between the Parties, existing at the time these Clauses are agreed or entered into thereafter,these Clauses shall prevail.
Clause 6
Description of the transfer(s)The details of the transfer(s), and in particular the categories of personal data that aretransferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 - Optional
Docking clause(a)An entity that is not a Party to these Clauses may, with the agreement of the Parties,
accede to these Clauses at any time, either as a data exporter or as a data importer, bycompleting the Appendix and signing Annex I.A.

(b)

Once it has completed the Appendix and signed Annex I.A, the acceding entity shallbecome a Party to these Clauses and have the rights and obligations of a data
exporter or data importer in accordance with its designation in Annex I.A.

(c)

The acceding entity shall have no rights or obligations arising under these Clauses
from the period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data
importer is able, through the implementation of appropriate technical and organisational
measures, to satisfy its obligations under these Clauses.
MODULE ONE: Transfer controller to controller
8.1

Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of thetransfer, as set out in Annex I.B. It may only process the personal data for another purpose:(i)where it has obtained the data subject’s prior consent;(ii)

where necessary for the establishment, exercise or defence of legal claims in
the context of specific administrative, regulatory or judicial proceedings; or(iii) where necessary in order to protect the vital interests of the data subject or ofanother natural person.
3

8.2

Transparency(a)

In order to enable data subjects to effectively exercise their rights pursuant toClause 10, the data importer shall inform them, either directly or through the data
exporter:(i)of its identity and contact details;(ii)of the categories of personal data processed;(iii) of the right to obtain a copy of these Clauses;(iv) where it intends to onward transfer the personal data to any third party/ies, ofthe recipient or categories of recipients (as appropriate with a view to providing
meaningful information), the purpose of such onward transfer and the groundtherefore pursuant to Clause 8.7.
(b)Paragraph (a) shall not apply where the data subject already has the information,
including when such information has already been provided by the data exporter, or
providing the information proves impossible or would involve a disproportionate
effort for the data importer. In the latter case, the data importer shall, to the extent
possible, make the information publicly available.

(c)

On request, the Parties shall make a copy of these Clauses, including the Appendix
as completed by them, available to the data subject free of charge. To the extent
necessary to protect business secrets or other confidential information, including
personal data, the Parties may redact part of the text of the Appendix prior to sharing
a copy, but shall provide a meaningful summary where the data subject would
otherwise not be able to understand its content or exercise his/her rights. On request,
the Parties shall provide the data subject with the reasons for the redactions, to theextent possible without revealing the redacted information.

(d)Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter
under Articles 13 and 14 of Regulation (EU) 2016/679.

8.3

Accuracy and data minimisation(a)Each Party shall ensure that the personal data is accurate and, where necessary, kept
up to date. The data importer shall take every reasonable step to ensure that personal
data that is inaccurate, having regard to the purpose(s) of processing, is erased or
rectified without delay.

(b)

If one of the Parties becomes aware that the personal data it has transferred or
received is inaccurate, or has become outdated, it shall inform the other Party without
undue delay.

(c)

The data importer shall ensure that the personal data is adequate, relevant and limited
to what is necessary in relation to the purpose(s) of processing.

8.4

Storage limitation

The data importer shall retain the personal data for no longer than necessary for the purpose(s)for which it is processed. It shall put in place appropriate technical or organisational measures4

to ensure compliance with this obligation, including erasure or anonymisation2 of the data andall back-ups at the end of the retention period.
8.5

Security of processing(a)The data importer and, during transmission, also the data exporter shall implement
appropriate technical and organisational measures to ensure the security of thepersonal data, including protection against a breach of security leading to accidental
or unlawful destruction, loss, alteration, unauthorised disclosure or access(hereinafter “personal data breach”). In assessing the appropriate level of security,
they shall take due account of the state of the art, the costs of implementation, thenature, scope, context and purpose(s) of processing and the risks involved in theprocessing for the data subject. The Parties shall in particular consider having
recourse to encryption or pseudonymisation, including during transmission, where
the purpose of processing can be fulfilled in that manner.

(b)

The Parties have agreed on the technical and organisational measures set out inAnnex II. The data importer shall carry out regular checks to ensure that thesemeasures continue to provide an appropriate level of security.

(c)

The data importer shall ensure that persons authorised to process the personal data
have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality.

(d)

In the event of a personal data breach concerning personal data processed by the data
importer under these Clauses, the data importer shall take appropriate measures toaddress the personal data breach, including measures to mitigate its possible adverse
effects.

(e)

In case of a personal data breach that is likely to result in a risk to the rights andfreedoms of natural persons, the data importer shall without undue delay notify both
the data exporter and the competent supervisory authority pursuant to Clause 13.
Such notification shall contain i) a description of the nature of the breach (including,where possible, categories and approximate number of data subjects and personal
data records concerned), ii) its likely consequences, iii) the measures taken or
proposed to address the breach, and iv) the details of a contact point from whom
more information can be obtained. To the extent it is not possible for the data
importer to provide all the information at the same time, it may do so in phases
without undue further delay.

(f)

In case of a personal data breach that is likely to result in a high risk to the rights andfreedoms of natural persons, the data importer shall also notify without undue delay
the data subjects concerned of the personal data breach and its nature, if necessary incooperation with the data exporter, together with the information referred to inparagraph (e), points ii) to iv), unless the data importer has implemented measures tosignificantly reduce the risk to the rights or freedoms of natural persons, ornotification would involve disproportionate efforts. In the latter case, the data
importer shall instead issue a public communication or take a similar measure to
inform the public of the personal data breach.

2This requires rendering the data anonymous in such a way that the individual is no longer identifiable byanyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible.

5

(g)

The data importer shall document all relevant facts relating to the personal data
breach, including its effects and any remedial action taken, and keep a record thereof.

8.6

Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions,religious or philosophical beliefs, or trade union membership, genetic data, or biometric data
for the purpose of uniquely identifying a natural person, data concerning health or a person’s
sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter“sensitive data”), the data importer shall apply specific restrictions and/or additionalsafeguards adapted to the specific nature of the data and the risks involved. This may include
restricting the personnel permitted to access the personal data, additional security measures(such as pseudonymisation) and/or additional restrictions with respect to further disclosure.
8.7

Onward transfers

The data importer shall not disclose the personal data to a third party located outside theEuropean Union 3 (in the same country as the data importer or in another third country,
hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses,
under the appropriate Module. Otherwise, an onward transfer by the data importer may only
take place if:(i)

it is to a country benefitting from an adequacy decision pursuant to Article 45
of Regulation (EU) 2016/679 that covers the onward transfer;(ii)

the third party otherwise ensures appropriate safeguards pursuant to Articles 46
or 47 of Regulation (EU) 2016/679 with respect to the processing in question;(iii) the third party enters into a binding instrument with the data importer ensuring
the same level of data protection as under these Clauses, and the data importer
provides a copy of these safeguards to the data exporter;(iv) it is necessary for the establishment, exercise or defence of legal claims in thecontext of specific administrative, regulatory or judicial proceedings;(v)

it is necessary in order to protect the vital interests of the data subject or ofanother natural person; or(vi) where none of the other conditions apply, the data importer has obtained the
explicit consent of the data subject for an onward transfer in a specific situation,
after having informed him/her of its purpose(s), the identity of the recipient andthe possible risks of such transfer to him/her due to the lack of appropriate dataprotection safeguards. In this case, the data importer shall inform the data
exporter and, at the request of the latter, shall transmit to it a copy of theinformation provided to the data subject.
Any onward transfer is subject to compliance by the data importer with all the othersafeguards under these Clauses, in particular purpose limitation.
3

The Agreement on the European Economic Area (EEA Agreement) provides for the extension of theEuropean Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union
data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has
been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party
located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

6

8.8

Processing under the authority of the data importer

The data importer shall ensure that any person acting under its authority, including aprocessor, processes the data only on its instructions.
8.9

Documentation and compliance(a)Each Party shall be able to demonstrate compliance with its obligations under these
Clauses. In particular, the data importer shall keep appropriate documentation of theprocessing activities carried out under its responsibility.

(b)

The data importer shall make such documentation available to the competentsupervisory authority on request.

Clause 10
Data subject rights
MODULE ONE: Transfer controller to controller(a)The data importer, where relevant with the assistance of the data exporter, shall deal
with any enquiries and requests it receives from a data subject relating to theprocessing of his/her personal data and the exercise of his/her rights under these
Clauses without undue delay and at the latest within one month of the receipt of theenquiry or request.4 The data importer shall take appropriate measures to facilitatesuch enquiries, requests and the exercise of data subject rights. Any information
provided to the data subject shall be in an intelligible and easily accessible form,
using clear and plain language.

(b)

In particular, upon request by the data subject the data importer shall, free of charge :(i)provide confirmation to the data subject as to whether personal data concerning
him/her is being processed and, where this is the case, a copy of the data
relating to him/her and the information in Annex I; if personal data has been or
will be onward transferred, provide information on recipients or categories ofrecipients (as appropriate with a view to providing meaningful information) towhich the personal data has been or will be onward transferred, the purpose ofsuch onward transfers and their ground pursuant to Clause 8.7; and provide
information on the right to lodge a complaint with a supervisory authority inaccordance with Clause 12(c)(i);(ii)

rectify inaccurate or incomplete data concerning the data subject;(iii) erase personal data concerning the data subject if such data is being or has beenprocessed in violation of any of these Clauses ensuring third-party beneficiaryrights, or if the data subject withdraws the consent on which the processing isbased.

4

That period may be extended by a maximum of two more months, to the extent necessary taking into accountthe complexity and number of requests. The data importer shall duly and promptly inform the data subject ofany such extension.

7

(c)

Where the data importer processes the personal data for direct marketing purposes, it
shall cease processing for such purposes if the data subject objects to it.

(d)

The data importer shall not make a decision based solely on the automatedprocessing of the personal data transferred (hereinafter “automated decision”), which
would produce legal effects concerning the data subject or similarly significantly
affect him / her, unless with the explicit consent of the data subject or if authorised to
do so under the laws of the country of destination, provided that such laws lays down
suitable measures to safeguard the data subject’s rights and legitimate interests. In
this case, the data importer shall, where necessary in cooperation with the data
exporter:(i)

inform the data subject about the envisaged automated decision, the envisaged
consequences and the logic involved; and(ii)

implement suitable safeguards, at least by enabling the data subject to contest
the decision, express his/her point of view and obtain review by a human being.

(e)Where requests from a data subject are excessive, in particular because of theirrepetitive character, the data importer may either charge a reasonable fee taking into
account the administrative costs of granting the request or refuse to act on the request.

(f)

The data importer may refuse a data subject’s request if such refusal is allowed under
the laws of the country of destination and is necessary and proportionate in a
democratic society to protect one of the objectives listed in Article 23(1) ofRegulation (EU) 2016/679.

(g)

If the data importer intends to refuse a data subject’s request, it shall inform the data
subject of the reasons for the refusal and the possibility of lodging a complaint withthe competent supervisory authority and/or seeking judicial redress.
Clause 11
Redress(a)

The data importer shall inform data subjects in a transparent and easily accessible
format, through individual notice or on its website, of a contact point authorised tohandle complaints. It shall deal promptly with any complaints it receives from a data
subject.

MODULE ONE: Transfer controller to controller(b)

In case of a dispute between a data subject and one of the Parties as regards
compliance with these Clauses, that Party shall use its best efforts to resolve the issue
amicably in a timely fashion. The Parties shall keep each other informed about suchdisputes and, where appropriate, cooperate in resolving them.

(c)Where the data subject invokes a third-party beneficiary right pursuant to Clause 3,
the data importer shall accept the decision of the data subject to:(i)lodge a complaint with the supervisory authority in the Member State of his/her
habitual residence or place of work, or the competent supervisory authority
pursuant to Clause 13;(ii)

refer the dispute to the competent courts within the meaning of Clause 18.
8

(d)The Parties accept that the data subject may be represented by a not-for-profit body,organisation or association under the conditions set out in Article 80(1) of Regulation(EU) 2016/679.

(e)

The data importer shall abide by a decision that is binding under the applicable EU or
Member State law.

(f)

The data importer agrees that the choice made by the data subject will not prejudice
his/her substantive and procedural rights to seek remedies in accordance withapplicable laws.
Clause 12
Liability

MODULE ONE: Transfer controller to controller(a)Each Party shall be liable to the other Party/ies for any damages it causes the otherParty/ies by any breach of these Clauses.

(b)

Each Party shall be liable to the data subject, and the data subject shall be entitled toreceive compensation, for any material or non-material damages that the Party causes
the data subject by breaching the third-party beneficiary rights under these Clauses.
This is without prejudice to the liability of the data exporter under Regulation (EU)2016/679.

(c)Where more than one Party is responsible for any damage caused to the data subject
as a result of a breach of these Clauses, all responsible Parties shall be jointly andseverally liable and the data subject is entitled to bring an action in court against anyof these Parties.

(d)

The Parties agree that if one Party is held liable under paragraph (c), it shall beentitled to claim back from the other Party/ies that part of the compensation
corresponding to its / their responsibility for the damage.

(e)

The data importer may not invoke the conduct of a processor or sub-processor to
avoid its own liability.

Clause 13
Supervision
MODULE ONE: Transfer controller to controller(a)[Where the data exporter is established in an EU Member State:] The supervisory
authority with responsibility for ensuring compliance by the data exporter with
Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C,
shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with
its Article 3(2) and has appointed a representative pursuant to Article 27(1) ofRegulation (EU) 2016/679:] The supervisory authority of the Member State in which
9the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679
is established, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within
the territorial scope of application of Regulation (EU) 2016/679 in accordance with
its Article 3(2) without however having to appoint a representative pursuant to
Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of theMember States in which the data subjects whose personal data is transferred underthese Clauses in relation to the offering of goods or services to them, or whose
behaviour is monitored, are located, as indicated in Annex I.C, shall act as competentsupervisory authority.
(b)

The data importer agrees to submit itself to the jurisdiction of and cooperate with thecompetent supervisory authority in any procedures aimed at ensuring compliancewith these Clauses. In particular, the data importer agrees to respond to enquiries,
submit to audits and comply with the measures adopted by the supervisory authority,
including remedial and compensatory measures. It shall provide the supervisory
authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY
PUBLIC AUTHORITIESClause 14
Local laws and practices affecting compliance with the Clauses
MODULE ONE: Transfer controller to controller(a)

The Parties warrant that they have no reason to believe that the laws and practices inthe third country of destination applicable to the processing of the personal data by
the data importer, including any requirements to disclose personal data or measuresauthorising access by public authorities, prevent the data importer from fulfilling its
obligations under these Clauses. This is based on the understanding that laws andpractices that respect the essence of the fundamental rights and freedoms and do not
exceed what is necessary and proportionate in a democratic society to safeguard oneof the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not incontradiction with these Clauses.

(b)

The Parties declare that in providing the warranty in paragraph (a), they have taken
due account in particular of the following elements:(i)the specific circumstances of the transfer, including the length of theprocessing chain, the number of actors involved and the transmission channels
used; intended onward transfers; the type of recipient; the purpose ofprocessing; the categories and format of the transferred personal data; theeconomic sector in which the transfer occurs; the storage location of the datatransferred;(ii)

the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorising access by
10

such authorities – relevant in light of the specific circumstances of the transfer,and the applicable limitations and safeguards5;(iii) any relevant contractual, technical or organisational safeguards put in place tosupplement the safeguards under these Clauses, including measures applied
during transmission and to the processing of the personal data in the country ofdestination.
(c)

The data importer warrants that, in carrying out the assessment under paragraph (b),it has made its best efforts to provide the data exporter with relevant information andagrees that it will continue to cooperate with the data exporter in ensuring
compliance with these Clauses.

(d)

The Parties agree to document the assessment under paragraph (b) and make itavailable to the competent supervisory authority on request.

(e)

The data importer agrees to notify the data exporter promptly if, after having agreed
to these Clauses and for the duration of the contract, it has reason to believe that it isor has become subject to laws or practices not in line with the requirements underparagraph (a), including following a change in the laws of the third country or ameasure (such as a disclosure request) indicating an application of such laws inpractice that is not in line with the requirements in paragraph (a). [For Module Three:
The data exporter shall forward the notification to the controller.](f)

Following a notification pursuant to paragraph (e), or if the data exporter otherwise
has reason to believe that the data importer can no longer fulfil its obligations underthese Clauses, the data exporter shall promptly identify appropriate measures (e.g.
technical or organisational measures to ensure security and confidentiality) to be
adopted by the data exporter and/or data importer to address the situation [forModule Three: , if appropriate in consultation with the controller]. The data exporter
shall suspend the data transfer if it considers that no appropriate safeguards for suchtransfer can be ensured, or if instructed by [for Module Three: the controller or] thecompetent supervisory authority to do so. In this case, the data exporter shall beentitled to terminate the contract, insofar as it concerns the processing of personal
data under these Clauses. If the contract involves more than two Parties, the data
exporter may exercise this right to termination only with respect to the relevant Party,
unless the Parties have agreed otherwise. Where the contract is terminated pursuant
to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities

5

As regards the impact of such laws and practices on compliance with these Clauses, different elements may
be considered as part of an overall assessment. Such elements may include relevant and documented practicalexperience with prior instances of requests for disclosure from public authorities, or the absence of such
requests, covering a sufficiently representative time-frame. This refers in particular to internal records orother documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior
management level, provided that this information can be lawfully shared with third parties. Where thispractical experience is relied upon to conclude that the data importer will not be prevented from complying
with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties toconsider carefully whether these elements together carry sufficient weight, in terms of their reliability andrepresentativeness, to support this conclusion. In particular, the Parties have to take into account whether
their practical experience is corroborated and not contradicted by publicly available or otherwise accessible,
reliable information on the existence or absence of requests within the same sector and/or the application of
the law in practice, such as case law and reports by independent oversight bodies.

11

MODULE ONE: Transfer controller to controller
15.1

Notification(a)

The data importer agrees to notify the data exporter and, where possible, the data
subject promptly (if necessary with the help of the data exporter) if it:(i)receives a legally binding request from a public authority, including judicial
authorities, under the laws of the country of destination for the disclosure of
personal data transferred pursuant to these Clauses; such notification shall
include information about the personal data requested, the requesting authority,
the legal basis for the request and the response provided; or(ii)becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of thecountry of destination; such notification shall include all information available
to the importer.

[For Module Three: The data exporter shall forward the notification to thecontroller.](b)

If the data importer is prohibited from notifying the data exporter and/or the data
subject under the laws of the country of destination, the data importer agrees to use
its best efforts to obtain a waiver of the prohibition, with a view to communicating as
much information as possible, as soon as possible. The data importer agrees todocument its best efforts in order to be able to demonstrate them on request of thedata exporter.

(c)

Where permissible under the laws of the country of destination, the data importer
agrees to provide the data exporter, at regular intervals for the duration of thecontract, with as much relevant information as possible on the requests received (inparticular, number of requests, type of data requested, requesting authority/ies,
whether requests have been challenged and the outcome of such challenges, etc.).
[For Module Three: The data exporter shall forward the information to thecontroller.](d)

The data importer agrees to preserve the information pursuant to paragraphs (a) to (c)for the duration of the contract and make it available to the competent supervisory
authority on request.

(e)Paragraphs (a) to (c) are without prejudice to the obligation of the data importer
pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it
is unable to comply with these Clauses.

15.2

Review of legality and data minimisation(a)

The data importer agrees to review the legality of the request for disclosure, inparticular whether it remains within the powers granted to the requesting publicauthority, and to challenge the request if, after careful assessment, it concludes that
there are reasonable grounds to consider that the request is unlawful under the lawsof the country of destination, applicable obligations under international law andprinciples of international comity. The data importer shall, under the same conditions,pursue possibilities of appeal. When challenging a request, the data importer shallseek interim measures with a view to suspending the effects of the request until the12competent judicial authority has decided on its merits. It shall not disclose thepersonal data requested until required to do so under the applicable procedural rules.
These requirements are without prejudice to the obligations of the data importer
under Clause 14(e).
(b)

The data importer agrees to document its legal assessment and any challenge to therequest for disclosure and, to the extent permissible under the laws of the country ofdestination, make the documentation available to the data exporter. It shall also makeit available to the competent supervisory authority on request. [For Module Three:
The data exporter shall make the assessment available to the controller.](c)

The data importer agrees to provide the minimum amount of information permissible
when responding to a request for disclosure, based on a reasonable interpretation of
the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination(a)

The data importer shall promptly inform the data exporter if it is unable to comply
with these Clauses, for whatever reason.

(b)

In the event that the data importer is in breach of these Clauses or unable to comply
with these Clauses, the data exporter shall suspend the transfer of personal data to thedata importer until compliance is again ensured or the contract is terminated. This iswithout prejudice to Clause 14(f).

(c)

The data exporter shall be entitled to terminate the contract, insofar as it concerns theprocessing of personal data under these Clauses, where:(i)the data exporter has suspended the transfer of personal data to the data
importer pursuant to paragraph (b) and compliance with these Clauses is notrestored within a reasonable time and in any event within one month ofsuspension;(ii)

the data importer is in substantial or persistent breach of these Clauses; or(iii) the data importer fails to comply with a binding decision of a competent courtor supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority [for Module
Three: and the controller] of such non-compliance. Where the contract involves morethan two Parties, the data exporter may exercise this right to termination only withrespect to the relevant Party, unless the Parties have agreed otherwise.
(d)[For Modules One, Two and Three: Personal data that has been transferred prior to
the termination of the contract pursuant to paragraph (c) shall at the choice of thedata exporter immediately be returned to the data exporter or deleted in its entirety.
The same shall apply to any copies of the data.] [For Module Four: Personal datacollected by the data exporter in the EU that has been transferred prior to thetermination of the contract pursuant to paragraph (c) shall immediately be deleted inits entirety, including any copy thereof.] The data importer shall certify the deletionof the data to the data exporter. Until the data is deleted or returned, the data importer
13

shall continue to ensure compliance with these Clauses. In case of local laws
applicable to the data importer that prohibit the return or deletion of the transferredpersonal data, the data importer warrants that it will continue to ensure compliancewith these Clauses and will only process the data to the extent and for as long as
required under that local law.
(e)Either Party may revoke its agreement to be bound by these Clauses where (i) theEuropean Commission adopts a decision pursuant to Article 45(3) of Regulation(EU) 2016/679 that covers the transfer of personal data to which these Clauses apply;or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country
to which the personal data is transferred. This is without prejudice to otherobligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law

MODULE ONE: Transfer controller to controller
These Clauses shall be governed by the law of one of the EU Member States, provided suchlaw allows for third-party beneficiary rights. The Parties agree that this shall be the law ofFederal Republic of Germany.

Clause 18
Choice of forum and jurisdiction
MODULE ONE: Transfer controller to controller(a)Any dispute arising from these Clauses shall be resolved by the courts of an EU
Member State.

(b)

The Parties agree that those shall be the courts of Federal Republic of Germany.

(c)

A data subject may also bring legal proceedings against the data exporter and/or data
importer before the courts of the Member State in which he/she has his/her habitualresidence.

(d)

The Parties agree to submit themselves to the jurisdiction of such courts.

14

APPENDIX
EXPLANATORY NOTE:
It must be possible to clearly distinguish the information applicable to each transfer or
category of transfers and, in this regard, to determine the respective role(s) of the Parties asdata exporter(s) and/or data importer(s). This does not necessarily require completing andsigning separate appendices for each transfer/category of transfers and/or contractual
relationship, where this transparency can achieved through one appendix. However, where
necessary to ensure sufficient clarity, separate appendices should be used.
ANNEX I
A. LIST OF PARTIESMODULE ONE: Transfer controller to controller
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable,of its/their data protection officer and/or representative in the European Union]
1. USUI International Germany GmbH
Schaerfengaesschen 4-6, 60311 Frankfurt am Main, Germany
Yoko Kimura, Vice President, YokoKimura@usui.co.jp
The data exporter provides customer services, market research, and logistics support in theEuropean automotive market. As a result of such business implementation, it is necessary totransfer personal data on business communication between the data exporter and the data
importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

15

Data importer(s): [Identity and contact details of the data importer(s), including any contact
person with responsibility for data protection]
1. USUI CO., LTD.
131-2, Nagasawa, Shimizu-cho, Sunto-gun, Shizuoka-ken, 411-8610 Japan
Hiroshi Yamanashi, President, HiroshiYamanashi@usui.co.jp
The data importer is the headquarters of the corporate group including the data exporter andsupplies automobile parts to European customers. As a result of such business implementation,
it is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

16

2. USUI International Corporation
44780 Helm Street, Plymouth, MI 48170 U.S.A.
TakayoshiIto, President, TakayoshiIto@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

17

3. USUI INTERNATIONAL MANUFACTURING MEXICO, S.A. DE C.V.
AV MINERAL DE PEÑAFIEL 111,PARQUE INDUSTRIAL SANTA FE IV PUERTO
INTERIOR SILAO DE LA VICTORIA, GTO C.P. 36275
Masato Yamada, President, MasatoYamada@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

18

4. Shanghai USUI Engine Parts Co., Ltd.
No.1188, Shenfu Rd. Xinzhuang Industrial Zone, Shanghai, 201108, China
Fukuei Cho, President, FukueiCho@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

19

5. USUI Automotive Parts(Shanghai) Co., Ltd.
No.118, Jinliu Rd, Jinshan Industrial Zone, Shanghai 201506 China
Fukuei Cho, President, FukueiCho@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

206. USUI Automotive Part(Foshan) Co., Ltd.
No.83, 2nd Road Xinyuan, Jili Industrial Park, Nanzhuang Town, Foshan City, Guangdong,
528061 China
Masahito Fukasawa, President, MasahitoFukasawa@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

21

7. USUI PIPE SYSTEM (HEFEI) CO., LTD.
2353 Penglai Road, Hefei Economic and Technological Development Area, Anhui, 230601
China
ShigeruMizuguchi, President, ShigeruMizuguchi@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

228. JIAXING USUI TSURUMI PRECISION TUBE INDUSTRY Co.,Ltd
NO.122 TianDaiQiao Road, JiaXing, Zhejiang Provice, China
Fukuei Cho, President, FukueiCho@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

23

9. USUI International Korea Co., Ltd.
#4, 9FL. Leaders Bldg., 63 Seochojungang-ro, Seocho-gu, Seoul, Republic of Korea 137-912
Ryozo Saito, Board Director, RyozoSaito@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

2410. USUI International Corporation (Thailand) Ltd.
Amata City Chonburi Industrial Estate 700/861 Moo 1 Tambol Phanthong, Amphur
Phanthong, Chonburi 20160, Thailand
Masahiro Shirai, President, MasahiroShirai@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

2511. PT.USUI INTERNATIONAL INDONESIA
Kawasan Greenland International Industrial Center Block AB No.6, Kota Deltamas, BekasiJawa Barat 17330, Indonesia
Hideto Tamakawa, President, HidetoTamakawa@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

2612. USUI SUSIRA INTERNATIONAL PRIVATE LIMITED
Plot No. I-2, Origin Mahindra World City, Central Avenue, Eliambedu Village, Ponneri Taluk,Thiruvallur, Tamilnadu 601204
Harutoshi Takagi, President, HarutoshiTakagi@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

2713. USUI INTERNATIONAL PHILIPPINES CORPORATION
122 East Science Avenue, Laguna Technopark Special Economic Zone, Binan, Laguna,Philippines 4024
YojiYamaguchi, President, YojiYamaguchi@usui.co.jp
It is necessary to transfer personal data on business communication between the data exporterand the data importer.

Signature and date:

21 December 2022

Role (controller/processor): Controller

28

B. DESCRIPTION OF TRANSFER
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
・Local employees of the data exporter
・Employees of the data exporter who are temporarily transferred on loan from the data
importer to the data exporter・Those employees of the data exporter with managerial positions
・Officers and directors of the data exporter
・Customer contact persons of the data exporter
Categories of personal data transferred・name, position, address, email, phone number, cellular phone number and such otherpersonal contact data of the data subjects.
・bank account of the employees who are temporarily transferred on loan from the data
importer to the data exporter in connection with salary practices.
・work performance of the employees of the data exporter and the evaluation on his/her
performance.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take
into consideration the nature of the data and the risks involved, such as for instance strict
purpose limitation, access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for onward transfers
or additional security measures.
・Passport and medical checkup information of employees of the data exporter who aretemporarily transferred on loan from the data importer to the data exporter
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous
basis).
・The data is transferred each time the categories of personal data is updated.

Nature of the processing
・collection, sharing, transmission, recording, storage, retrieval, use, editing, analysis andsuch other processing of personal data as may be necessary for the data exporter's business
operation.
Purpose(s) of the data transfer and further processing
29

・for the transfer outside EEA of personal data of the employees of the data exporter and thedata exporter’s customer contact persons and representatives in connection with generalbusiness communication between the data exporter, the data importers and customer
companies.
・for the transfer outside EEA of personal data of the employees of the data exporter who aretemporarily transferred on loan from the data importer to the data exporter in connection withsalary practices.
・ for the transfer outside EEA of personal data of employees of the data exporter inconnection with the personnel evaluation report.
・for the transfer outside EEA of personal data of the data exporter’s customer contact
persons and representatives in connection with the sales activity reports such as minutes.
The period for which the personal data will be retained, or, if that is not possible, the criteria
used to determine that period
・Per criteria described in Clause 8.4

C. COMPETENT SUPERVISORY AUTHORITY
MODULE ONE: Transfer controller to controller
Identify the competent supervisory authority/ies in accordance with Clause 13
・Federal Commissioner for Data Protection and Freedom of Information(BfDI)

30

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDINGTECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY
OF THE DATAMODULE ONE: Transfer controller to controller
EXPLANATORY NOTE:
The technical and organisational measures must be described in specific (and not generic)terms. See also the general comment on the first page of the Appendix, in particular on theneed to clearly indicate which measures apply to each transfer/set of transfers.
Description of the technical and organisational measures implemented by the data
importer(s) (including any relevant certifications) to ensure an appropriate level of security,
taking into account the nature, scope, context and purpose of the processing, and the risks forthe rights and freedoms of natural persons.
Measures of pseudonymisation and encryption of personal data
Ensure that sensitive personal data is encrypted and password-protected.
Ensure that personal data is securely transmitted and received by using Microsoft's Exchange
Online with TLS (Transport Layer Security) encryption, and only authorized persons canaccess shared documents by connecting to secure links created on cloud-based systems with
Microsoft SahrePoint and Teams.
Measures for ensuring ongoing confidentiality, integrity, availability and resilience ofprocessing systems and services(1)Confidentiality: Ensure that system access rights are set and complexity and expiration
dates are applied to passwords.
(2)Integrity: Ensure that access logs are recorded and backed up.
(3)Availability: Ensure that disaster preparedness in server rooms, redundant disk,
uninterruptible power supplies, and business continuity plan(BCP) are implemented.
Measures for ensuring the ability to restore the availability and access to personal data in atimely manner in the event of a physical or technical incident
Ensure that all data will be backed up weekly with full backups and daily incremental backups,
and all backup media will be securely stored away from the network.
Processes for regularly testing, assessing and evaluating the effectiveness of technical andorganisational measures in order to ensure the security of the processing
Ensure that risk assessments using security risk assessment tools are performed on a regularbasis.
Measures for user identification and authorisation
Ensure that all users are issued individual user IDs and that access rights are set by user ID.
To authenticate, passwords with required complexity requirements are used, ensuring thatpasswords are changed regularly.

31Measures for the protection of data during transmission
Ensure that confidential information between the data exporter and the data importe issecurely transmitted and received using by Microsoft's Exchange Online with TLS(Transport Layer Security) encryption, and only authorized persons can access shareddocuments by connecting to secure links created on cloud-based systems with Microsoft
SahrePoint and Teams.
Measures for the protection of data during storage
Ensure that sensitive personal data is encrypted and only authorized persons have access.
Measures for ensuring physical security of locations at which personal data are processed
File servers and authentication servers where personal data is stored are located in a dedicatedserver room and ID card authentication ensures that only a very limited number of people canenter. The email and file sharing services used for the transfer of personal data are governedby Microsoft Terms of Use.
Measures for ensuring events logging
Ensure that servers where personal data is stored are event logged, that full backups are
performed once a week and differential backups are performed daily, and that backup media
is stored securely and disconnected from the network.
Measures for ensuring system configuration, including default configuration
Ensure that system configuration and specifications will be backed up weekly with fullbackups and daily incremental backups, and all backup media will be securely stored awayfrom the network.
Measures for internal IT and IT security governance and management
Ensure that security governance is established by organizing information management
officers and networking promotion committee members.
Measures for certification/assurance of processes and products
Processing of personal data requires approval of the information management officer.
Measures for ensuring data minimisation
Ensure that personal data obtained from the data exporter is kept to a minimum for processing
purposes only.
Measures for ensuring data quality
Ensure that data is corrected promptly upon request by the data subject, and that it is accurate,complete, and up-to-date.
Measures for ensuring limited data retention
Ensure that personal data obtained from the data exporter is retained only for as long as it'sneeded for the purpose of processing.
Measures for ensuring accountability
Ensure that all employees who handle data are regularly trained for information security.
Ensure that any employee who does not comply will be penalized in accordance with theregulations.

32

Measures for allowing data portability and ensuring erasure
Upon receipt of a request from a data subject for the right to data portability of personal data,
ensure that such data is provided in a readable format.
When a data subject requests erasure of data, ensure that the data is erased unless there is alegal obligation to keep the data,regulatory obligations,or other legitimate business reason.

33