EXHIBIT A
ELECTIONS MADE UNDER THE CLAUSES FOR MODULE FOUR OF
COMMISSION IMPLEMENTING DECISION (EU) 2021/914
on standard contractual clauses for the transfer of personal data to third countries
pursuant to Regulation (EU) 2016/679 of the European Parliament and of theCouncil
dated June 4, 2021 (C 2021) 3972 final

Clause 7 (Docking clause) – Optional clause is elected.
Clause 11 (Redress) - Optional wording in Clause 11(a) is NOT elected.
Clause 17 (Governing law): “These Clauses shall be governed by the law of a country
allowing for third-party beneficiary rights. The Parties agree that this shall be the lawof the Netherlands.”
Clause 18 (Choice of forum and jurisdiction): “Any dispute arising from these Clauses
shall be resolved by the courts of Amsterdam, the Netherlands.”

Such elections are modified as follows when transfers occur from Switzerland, UK orBrazil, to a Third Country such as to the United States of America:(UK) In respect of any data transfer(s) relating to Personal Data of UK residents (“UKPersonal Data”), the Clauses shall be interpreted in accordance with the “UK Addendum
to the EU Commission Standard Contractual Clauses” (“UK Addendum”) (accessible underthelink
https://ico.org.uk/media/about-the-ico/consultations/2620398/draft-icoaddendum-to-com-scc-20210805.pdf), adopted by reference, as published by the UK
Information Commissioner’s Office (“ICO”) and as finally adopted, amended or replacedat any time.
In particular, in respect of any data transfer(s) relating to Personal Data of UK residents("UK Personal Data”), the Clauses shall be interpreted as references to the UK Data

Protection Act and the UK General Data Protection Regulation (together “UK Data
Protection Laws”). In particular, the ICO shall be the competent supervisory authority
insofar as the data transfer is governed by the UK Data Protection Laws, references tospecific Articles of the GDPR shall be replaced with the equivalent article or section of theUK Data Protection Laws ; (iii) references to "EU", "Union", "Member State" and "Member
State law" shall be replaced with references to "UK"; (iv) Clause 13(a) and Part C of Annex
II shall not be used (v) references to the "competent supervisory authority" and"competent courts" shall be replaced with references to the "ICO" and the "competentcourts of London, UK " ; (vi) in Clause 17, the SCCs shall be governed by the laws of UK;and (vii) in Clause 18(b), disputes shall be resolved before the courts of London, UK.
(Switzerland) In respect of any data transfer(s) relating to Personal Data of Swissresidents (“Swiss Personal Data”), the Clauses shall be modified in accordance with thestatement of the Swiss Federal Data Protection and Information Commissioner (“FDPIC”)
of27
August2021(availableat:https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Paper%20SCC%20de
f.en%2024082021.pdf.download.pdf/Paper%20SCC%20def.en%2024082021.pdf ).
Inparticular: the FDPIC shall be the competent supervisory authority insofar as the datatransfer is governed by the Swiss Federal Act on Data Protection (“FADP”) with parallel
supervision together with the EU competent supervisory authority (Clause 13); the law of
the EU country specified by the Clauses shall be the governing law (Clause 17); the courtsof the EU country as specified by the Clauses shall be the choice of forum (Clause 18), but
this shall not exclude individuals in Switzerland from the possibility of bringing a claim intheir place of habitual residence in Switzerland, in accordance with Clause 18(c). Theparties agree to adjust the protection of the Personal Data upon entry into force of therevised FADP. For the avoidance of doubt, the UK Addendum shall be deemed effective
concurrently with the SCCs.

(Brazil) In respect of any data transfer(s) relating to Personal Data of Brazilian residents("Brazilian Personal Data”), the Clauses shall be interpreted as references to the Brazil
Federal Data Privacy Law (LGPD). In particular, the Brazilian National Data Protection
Authority (ANPD) shall be the competent supervisory authority insofar as the datatransfer is governed by the LGPD, references to specific Articles of the GDPR shall bereplaced with the equivalent article or section of the LGPD ; (iii) references to "EU","Union", "Member State" and "Member State law" shall be replaced with references to"Brazil"; (iv) Clause 13(a) and Part C of Annex II shall not be used (v) references to the"competent supervisory authority" and "competent courts" shall be replaced withreferences to the "ANPD" and the "competent courts of Sao Paolo, Brazil" ; (vi) in Clause17, the SCCs shall be governed by the laws of Brazil; and (vii) in Clause 18(b), disputes shallbe resolved before the courts of Sao Paolo, Brazil.
APPENDIX TO THE CLAUSESANNEX IA.

LIST OF PARTIES

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, ofits/their data protection officer and/or representative in the European Union]
1. Name: ___________________________________________
Address: _________________________________________
Contact person’s name, position and contact details: ____________________________________________________________________________________________
Activities relevant to the data transferred under these Clauses:______________________________________________________________________________________________________________________________________
Role (controller/processor): Processor
Signature and date:
Name & Title: ___________________________________________________
Date: ___________________________________________________
2. [insert additional exporters as applicable]
Data importer(s):1. Name: Alnylam Pharmaceuticals, Inc.
Address: 675 W Kendall Street, Cambridge, MA 02142 USA,
Contact person’s name, position and contact details: Attention: Privacy Officer, E-mail:privacy@alnylam.com
EU Privacy Office: ALNYLAM Switzerland GmbH, Attention: Privacy Office, Grafenauweg
4, 6300 Zug, Switzerland, E-mail: eudataprivacy@alnylam.com
EU Representative: Alnylam Netherlands B.V., Antonio Vivaldistraat 150, 1083 HP
Amsterdam, Nederland, info@alnylam.nl, Tel: 0800 403 0002 / 020 3697850

Activities relevant to the data transferred under these Clauses:______________________________________________________________________________________________________________________________________
Role (controller/processor): Controller
Signature and date:
Name & Title: ___________________________________________________
Date: ___________________________________________________
2. [insert additional importers as applicable]

B.

DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred☐ Alnylam employees and contractors, representatives or agents (past, presentand future)☐ Job applicants / candidates (successful / unsuccessful)☐ healthcare professionals☐ medical professionals,☐ pharmacists☐ caregivers☐ patients☐ research participants☐ family members☐ Other (please specify):…………………

Categories of personal data transferred☐ personal information (e.g. name, surname, family name)☐ Government identifiers (e.g., driving license number, NBI, national identifiers)☐ Contact information (e.g. work address, work phone number, work mobilenumber, work email)☐ Employment information (e.g. employer, institution’s name, job title,function/department)☐ Education and skills (e.g., CV related information, languages, educationaldegrees)☐ Professional experience & affiliations (e.g., CV information)☐ Family information (married/unmarried, no. of children)☐ Financial & economic information (bank account details, IBAN, credit carddetails)☐ Travel and expense information☐ Social media information (e.g. social name)☐ Browsing information (e.g., cookies, IP address)☐ system/user account information (e.g. username, password)☐ Coded / aggregated data in the form of a report☐ Other (please specify):…………………

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into
consideration the nature of the data and the risks involved, such as for instance strict purpose
limitation, access restrictions (including access only for staff having followed specialisedtraining), keeping a record of access to the data, restrictions for onward transfers or additional
security measures.
☐ information revealing racial or ethnic origin☐ data concerning a natural person’s sex life or sexual orientation☐ political opinions,☐ religious or philosophical beliefs☐ trade union memberships☐ Biometric information☐ Genetic information☐ Health related information (including lab results and medical information) (e.g.
data relating to adverse events and safety and quality information)☐ Background check information and/or data relating to criminal convictions andoffences☐ None

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuousbasis).
Nature of the processing[insert short description of the processing operations relevant to the Services to be provided
under the MSA]
Purpose(s) of the data transfer and further processing
Performance of the Services in accordance with the Agreement and/or any relevant Statement ofWork between the data exporter and the data importer
The period for which the personal data will be retained, or, if that is not possible, the criteria used
to determine that period
For the duration necessary to perform the Services under the Agreement and or theapplicable Statement of Work and for such period thereafter as permitted or required bylaw.

For transfers to (sub-) processors, also specify subject matter, nature and duration of theprocessing
Sub-processors
Name & Address

Type ofagreement inplace with data
importer &effective date

Scope of Services(subject matter,nature andduration of theprocessing)TargetCountry

Adequacy
Safeguard