EXHIBIT A
ELECTIONS MADE UNDER THE CLAUSES FOR MODULE ONE OF
COMMISSION IMPLEMENTING DECISION (EU) 2021/914
on standard contractual clauses for the transfer of personal data to third countries
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council
dated June 4, 2021 (C 2021) 3972 final

Clause 7 (Docking clause) – Optional clause is elected.
Clause 11 (Redress) - Optional wording in Clause 11(a) is NOT elected.
Clause 13 (Supervision) –[Where the data exporter is established in an EU Member State:] The supervisory authority
with responsibility for ensuring compliance by the data exporter with Regulation (EU)2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competentsupervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within theterritorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2)and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:]
The supervisory authority of the Member State in which the representative within themeaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C,shall act as competent supervisory authority.
Clause 17 (Governing law): “These Clauses shall be governed by the law of one of the EU
Member States, provided such law allows for third- party beneficiary rights. The Parties agree
that this shall be the law of the Netherlands”
Clause 18 (Choice of forum and jurisdiction): “The Parties agree that those shall be the courtsof Amsterdam, the Netherlands.”

Such elections are modified as follows when transfers occur from Switzerland, UK or Brazil, to a Third
Country such as to the United States of America:(UK) In respect of any data transfer(s) relating to Personal Data of UK residents (“UK Personal Data”), theClauses shall be interpreted in accordance with the “UK Addendum to the EU Commission Standard
Contractual Clauses” (“UK Addendum”) (accessible under the link https://ico.org.uk/media/about-theico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf), adopted by reference, aspublished by the UK Information Commissioner’s Office (“ICO”) and as finally adopted, amended orreplaced at any time.
In particular, in respect of any data transfer(s) relating to Personal Data of UK residents ("UK PersonalData”), the Clauses shall be interpreted as references to the UK Data Protection Act and the UK General
Data Protection Regulation (together “UK Data Protection Laws”). In particular, the ICO shall be thecompetent supervisory authority insofar as the data transfer is governed by the UK Data Protection Laws,
references to specific Articles of the GDPR shall be replaced with the equivalent article or section of theUK Data Protection Laws ; (iii) references to "EU", "Union", "Member State" and "Member State law" shallbe replaced with references to "UK"; (iv) Clause 13(a) and Part C of Annex II shall not be used (v) references
to the "competent supervisory authority" and "competent courts" shall be replaced with references to the"ICO" and the "competent courts of London, UK " ; (vi) in Clause 17, the SCCs shall be governed by the lawsof UK; and (vii) in Clause 18(b), disputes shall be resolved before the courts of London, UK.
(Switzerland) In respect of any data transfer(s) relating to Personal Data of Swiss residents (“SwissPersonal Data”), the Clauses shall be modified in accordance with the statement of the Swiss Federal Data
Protection and Information Commissioner (“FDPIC”) of 27 August 2021 (available
at:https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Paper%20SCC%20def.en%20240820
21.pdf.download.pdf/Paper%20SCC%20def.en%2024082021.pdf ). In particular: the FDPIC shall be thecompetent supervisory authority insofar as the data transfer is governed by the Swiss Federal Act on Data
Protection (“FADP”) with parallel supervision together with the EU competent supervisory authority(Clause 13); the law of the EU country specified by the Clauses shall be the governing law (Clause 17); thecourts of the EU country as specified by the Clauses shall be the choice of forum (Clause 18), but this shallnot exclude individuals in Switzerland from the possibility of bringing a claim in their place of habitualresidence in Switzerland, in accordance with Clause 18(c). The parties agree to adjust the protection of thePersonal Data upon entry into force of the revised FADP. For the avoidance of doubt, the UK Addendum
shall be deemed effective concurrently with the SCCs.

(Brazil) In respect of any data transfer(s) relating to Personal Data of Brazilian residents ("BrazilianPersonal Data”), the Clauses shall be interpreted as references to the Brazil Federal Data Privacy Law(LGPD). In particular, the Brazilian National Data Protection Authority (ANPD) shall be the competentsupervisory authority insofar as the data transfer is governed by the LGPD, references to specific Articlesof the GDPR shall be replaced with the equivalent article or section of the LGPD ; (iii) references to "EU","Union", "Member State" and "Member State law" shall be replaced with references to "Brazil"; (iv) Clause13(a) and Part C of Annex II shall not be used (v) references to the "competent supervisory authority" and"competent courts" shall be replaced with references to the "ANPD" and the "competent courts of SaoPaolo, Brazil" ; (vi) in Clause 17, the SCCs shall be governed by the laws of Brazil; and (vii) in Clause 18(b),disputes shall be resolved before the courts of Sao Paolo, Brazil.
APPENDIXANNEX I
A. LIST OF PARTIES
Data exporter(s):1. Name: … Alnylam Pharmaceuticals, Inc.
Address: … 675 W Kendall Street, Cambridge, MA 02142 USA,
Tel: 844.543.8355 URL: www.alnylam.com
Contact person’s name, position and contact details: Attention: Privacy Officer, E-mail:privacy@alnylam.com
EU Privacy Office: ALNYLAM Switzerland GmbH, Attention: Privacy Office, Grafenauweg 4,6300 Zug, Switzerland, E-mail: eudataprivacy@alnylam.com
EU Representative: Alnylam Netherlands B.V., Antonio Vivaldistraat 150, 1083 HP Amsterdam,
Nederland, info@alnylam.nl, Tel: 0800 403 0002 / 020 3697850

Activities relevant to the data transferred under these Clauses: [e.g. Market Research activities]
Signature and date: …
Role (controller/processor): … Controller

2. …
Data importer(s): [Identity and contact details of the data importer(s), including any contact
person with responsibility for data protection]
1. Name: …
Address: …
Main Tel: [insert general telephone]E-mail: [insert general email], URL: [insert general telephone]Contact person’s name, position and contact details: …
EU Privacy Office (where relevant):
EU Representative (where relevant):
Activities relevant to the data transferred under these Clauses: [e.g. Market Research activities]
Signature and date: …
Role (controller/processor): … Controller

2. …

B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred☐ Alnylam employees and contractors, representatives or agents (past, present and future)☐ Job applicants / candidates (successful / unsuccessful)☐ healthcare professionals☐ medical professionals,☐ pharmacists☐ caregivers☐ patients☐ research participants☐ family members☐ Other (please specify):…………………

Categories of personal data transferred☐ personal information (e.g. name, surname, family name)☐ Government identifiers (e.g., driving license number, NBI, national identifiers)☐ Contact information (e.g. work address, work phone number, work mobile number, work email)☐ Employment information (e.g. employer, institution’s name, job title, function/department)☐ Education and skills (e.g., CV related information, languages, educational degrees)☐ Professional experience & affiliations (e.g., CV information)☐ Family information (married/unmarried, no. of children)☐ Financial & economic information (bank account details, IBAN, credit card details)☐ Travel and expense information☐ Social media information (e.g. social name)☐ Browsing information (e.g., cookies, IP address)☐ system/user account information (e.g. username, password)☐ Coded / aggregated data in the form of a report☐ Other (please specify):…………………

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take
into consideration the nature of the data and the risks involved, such as for instance strict
purpose limitation, access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for onward transfers
or additional security measures.
☐ information revealing racial or ethnic origin

☐ data concerning a natural person’s sex life or sexual orientation☐ political opinions,☐ religious or philosophical beliefs☐ trade union memberships☐ Biometric information☐ Genetic information☐ Health related information (including lab results and medical information) (e.g. data relating to adverse
events and safety and quality informaiton)☐ Background check information and/or data relating to criminal convictions and offences☐ None

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuousbasis).
………………..

Nature of the processing
Performance of the Services in accordance with the Agreement and/or relevant Statement ofWork between the data exporter and the data importer.

Purpose(s) of the data transfer and further processing
Performance of the Services and related market research activities in accordance with theAgreement and/or relevant Statement of Work between the data exporter and the data importer.

The period for which the personal data will be retained, or, if that is not possible, the criteria
used to determine that period
For the duration necessary to perform the Services under the Agreement and or the applicable
Statement of Work and for such period thereafter as permitted or required by law.

For transfers to (sub-) processors, also specify subject matter, nature and duration of theprocessing
Sub-processors Name &Address

Type of agreement inplace with data

Scope of Services(subject matter, nature

Target Country

Adequacy
Safeguardimporter & effective
dateand duration of theprocessing)C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13
Autoriteit PersoonsgegevensBezuidenhoutseweg 30,P.O. Box 93374
2509 AJ Den Haag/The Hague
Tel. +31 70 888 8500
Fax +31 70 888 8501
Website: https://autoriteitpersoonsgegevens.nl/

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURESINCLUDING TECHNICAL AND ORGANISATIONAL MEASURESTO ENSURE THE SECURITYOF THE DATA

The minimum technical and organisational measures to be implemented by
the data importer(s) (including any relevant certifications) to ensure anappropriate level of security, taking into account the nature, scope, context andpurpose of the processing, and the risks for the rights and freedoms of natural
persons are those set out in on https://alnylampolicies.com/.

Alnylam_Third_Party_S
ecurity_Measures.pdf