EXHIBIT A
ELECTIONS MADE UNDER THE CLAUSES FOR MODULE TWO OFCOMMISSION IMPLEMENTING DECISION (EU) 2021/914
on standard contractual clauses for the transfer of personal data to third countries pursuant toRegulation (EU) 2016/679 of the European Parliament and of the Council
dated June 4, 2021 (C 2021) 3972 final

Clause 7 (Docking clause) – Optional clause is elected.
Clause 9 (Use of sub-processors) – Applicable only to Module 2: Transfer Controller to Processor:
OPTION 2: GENERAL WRITTEN AUTHORISATION is elected:
The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s)from an agreed list. The data importer shall specifically inform the data exporter in writing of any
intended changes to that list through the addition or replacement of sub-processors at least 30 days inadvance, thereby giving the data exporter sufficient time to be able to object to such changes prior to
the engagement of the sub-processor(s). The data importer shall provide the data exporter with theinformation necessary to enable the data exporter to exercise its right to object.”
Clause 11 (Redress) - Optional wording in Clause 11(a) is NOT elected.
Clause 13 (Supervision)[Where the data exporter is established in an EU Member State:] The supervisory authority withresponsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards
the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scopeof application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a
representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of theMember State in which the representative within the meaning of Article 27(1) of Regulation (EU)2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.
Clause 17 (Governing law): “These Clauses shall be governed by the law of the EU Member State inwhich the data exporter is established. Where such law does not allow for third-party beneficiary rights,
they shall be governed by the law of another EU Member State that does allow for third-party
beneficiary rights. The Parties agree that this shall be the law of the Netherlands.”
Clause 18 (Choice of forum and jurisdiction):

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of Amsterdam, the Netherlands (specify MemberState).
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer
before the courts of the Member State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
Such elections are modified as follows when transfers occur from Switzerland, UK or Brazil, to a Third
Country such as to the United States of America:(UK) In respect of any data transfer(s) relating to Personal Data of UK residents (“UK Personal Data”), theClauses shall be interpreted in accordance with the “UK Addendum to the EU Commission Standard
Contractual Clauses” (“UK Addendum”) (accessible under the link https://ico.org.uk/media/about-theico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf), adopted by reference, aspublished by the UK Information Commissioner’s Office (“ICO”) and as finally adopted, amended orreplaced at any time.
In particular, in respect of any data transfer(s) relating to Personal Data of UK residents ("UK PersonalData”), the Clauses shall be interpreted as references to the UK Data Protection Act and the UK General
Data Protection Regulation (together “UK Data Protection Laws”). In particular, the ICO shall be thecompetent supervisory authority insofar as the data transfer is governed by the UK Data Protection Laws,
references to specific Articles of the GDPR shall be replaced with the equivalent article or section of theUK Data Protection Laws ; (iii) references to "EU", "Union", "Member State" and "Member State law" shallbe replaced with references to "UK"; (iv) Clause 13(a) and Part C of Annex II shall not be used (v) references
to the "competent supervisory authority" and "competent courts" shall be replaced with references to the"ICO" and the "competent courts of London, UK " ; (vi) in Clause 17, the SCCs shall be governed by the lawsof UK; and (vii) in Clause 18(b), disputes shall be resolved before the courts of London, UK.
(Switzerland) In respect of any data transfer(s) relating to Personal Data of Swiss residents (“SwissPersonal Data”), the Clauses shall be modified in accordance with the statement of the Swiss Federal Data
Protection and Information Commissioner (“FDPIC”) of 27 August 2021 (available
at:https://www.edoeb.admin.ch/dam/edoeb/en/dokumente/2021/Paper%20SCC%20def.en%20240820
21.pdf.download.pdf/Paper%20SCC%20def.en%2024082021.pdf ). In particular: the FDPIC shall be thecompetent supervisory authority insofar as the data transfer is governed by the Swiss Federal Act on Data
Protection (“FADP”) with parallel supervision together with the EU competent supervisory authority(Clause 13); the law of the EU country specified by the Clauses shall be the governing law (Clause 17); thecourts of the EU country as specified by the Clauses shall be the choice of forum (Clause 18), but this shallnot exclude individuals in Switzerland from the possibility of bringing a claim in their place of habitualresidence in Switzerland, in accordance with Clause 18(c). The parties agree to adjust the protection of thePersonal Data upon entry into force of the revised FADP. For the avoidance of doubt, the UK Addendum

shall be deemed effective concurrently with the SCCs.

(Brazil) In respect of any data transfer(s) relating to Personal Data of Brazilian residents ("BrazilianPersonal Data”), the Clauses shall be interpreted as references to the Brazil Federal Data Privacy Law(LGPD). In particular, the Brazilian National Data Protection Authority (ANPD) shall be the competentsupervisory authority insofar as the data transfer is governed by the LGPD, references to specific Articlesof the GDPR shall be replaced with the equivalent article or section of the LGPD ; (iii) references to "EU","Union", "Member State" and "Member State law" shall be replaced with references to "Brazil"; (iv) Clause13(a) and Part C of Annex II shall not be used (v) references to the "competent supervisory authority" and"competent courts" shall be replaced with references to the "ANPD" and the "competent courts of Sao
Paolo, Brazil" ; (vi) in Clause 17, the SCCs shall be governed by the laws of Brazil; and (vii) in Clause 18(b),disputes shall be resolved before the courts of Sao Paolo, Brazil.

APPENDIXANNEX I
A. LIST OF PARTIES
Data exporter(s):1. Name: … Alnylam Pharmaceuticals, Inc.
Address: … 675 W Kendall Street, Cambridge, MA 02142 USA,
Tel: 844.543.8355 URL: www.alnylam.com
Contact person’s name, position and contact details: Attention: Privacy Officer, E-mail:privacy@alnylam.com
EU Privacy Office: ALNYLAM Switzerland GmbH, Attention: Privacy Office, Grafenauweg 4,6300 Zug, Switzerland, E-mail: eudataprivacy@alnylam.com
EU Representative: Alnylam Netherlands B.V., Antonio Vivaldistraat 150, 1083 HP Amsterdam,
Nederland, info@alnylam.nl, Tel: 0800 403 0002 / 020 3697850

Activities relevant to the data transferred under these Clauses: [e.g. conducting clinical research]
Signature and date: …
Role (controller/processor): … Controller

2. …

Data importer(s): [Identity and contact details of the data importer(s), including any contact
person with responsibility for data protection]
1. Name: …
Address: …
Main Tel: [insert general telephone]
E-mail: [insert general email], URL: [insert general telephone]Contact person’s name, position and contact details: …
EU Privacy Office (where relevant): ………………
EU Representative (where relevant): ………………..
Activities relevant to the data transferred under these Clauses: [e.g. diagnostic lab services]
Signature and date: …
Role (controller/processor): …Processor
2. …

B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred☐ Alnylam employees and contractors, representatives or agents (past, present and future)☐ Job applicants / candidates (successful / unsuccessful)☐ healthcare professionals☐ medical professionals,☐ pharmacists☐ caregivers☐ patients☐ research participants☐ family members☐ Other (please specify):…………………

Categories of personal data transferred☐ personal information (e.g. name, surname, family name)☐ Government identifiers (e.g., driving license number, NBI, national identifiers)☐ Contact information (e.g. work address, work phone number, work mobile number, work email)☐ Employment information (e.g. employer, institution’s name, job title, function/department)☐ Education and skills (e.g., CV related information, languages, educational degrees)☐ Professional experience & affiliations (e.g., CV information)☐ Family information (married/unmarried, no. of children)☐ Financial & economic information (bank account details, IBAN, credit card details)☐ Travel and expense information☐ Social media information (e.g. social name)☐ Browsing information (e.g., cookies, IP address)☐ system/user account information (e.g. username, password)☐ Coded / aggregated data in the form of a report☐ Other (please specify):…………………

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take
into consideration the nature of the data and the risks involved, such as for instance strict
purpose limitation, access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for onward transfers
or additional security measures.

☐ information revealing racial or ethnic origin☐ data concerning a natural person’s sex life or sexual orientation☐ political opinions,☐ religious or philosophical beliefs☐ trade union memberships☐ Biometric information☐ Genetic information☐ Health related information (including lab results and medical information) (e.g. data relating to adverse
events and safety and quality information)☐ Background check information and/or data relating to criminal convictions and offences☐ None

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuousbasis).
…………………………
Nature of the processing[insert short description of the scope of services to be provided under the MSA]
Purpose(s) of the data transfer and further processing
Performance of the Services in accordance with the Agreement and/or any relevant Statement ofWork between the data exporter and the data importer

The period for which the personal data will be retained, or, if that is not possible, the criteria
used to determine that period
For the duration necessary to perform the Services under the Agreement and or the applicable
Statement of Work and for such period thereafter as permitted or required by law.

For transfers to (sub-) processors, also specify subject matter, nature and duration of theprocessing
Sub-processors Name &Address

Type of agreement inplace with data
importer & effective
date

Scope of Services(subject matter, natureand duration of theprocessing)Target Country

Adequacy
Safeguard

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13[For EU Countries:
insert the local data protection authority under whose supervision the local Alnylam EU entity rests; alist with the names and contact details of the EU competent authorities is available here:
https://edpb.europa.eu/about-edpb/about-edpb/members_ene.g. for Alnylam France it would be the French CNIL:
Commission Nationale de l'Informatique et des Libertés - CNIL
3 Place de Fontenoy
TSA 80715 – 75334 Paris, Cedex 07
Tel. +33 1 53 73 22 22
Fax +33 1 53 73 22 00
Website: http://www.cnil.fr/ https://www.cnil.fr/en/contact-cnil ][For Alnylam Inc, Alnylam Switzerland and Alnylam UK, insert the Dutch Authority:]
Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30,P.O. Box 93374
2509 AJ Den Haag/The Hague
Tel. +31 70 888 8500
Fax +31 70 888 8501
Website: https://autoriteitpersoonsgegevens.nl/

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURESINCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO
ENSURE THE SECURITYOF THE DATA

The minimum technical and organisational measures to be implemented by thedata importer(s) (including any relevant certifications) to ensure an appropriate
level of security, taking into account the nature, scope, context and purpose of theprocessing, and the risks for the rights and freedoms of natural persons are thoseset out in on https://alnylampolicies.com/.

Alnylam_Third_Party_S
ecurity_Measures.pdf

For transfers to (sub-) processors, also describe the specific technical andorganisational measures to be taken by the (sub-) processor to be able to provide
assistance to the controller and, for transfers from a processor to a sub-processor,
to the data exporter

ALNYLAM Proprietary and Confidential
Control Version Date 26.01.2021-8-ANNEX III – LIST OF SUB-PROCESSORS
The controller has authorised the use of the following sub-processors:
1. Name: …
Address: …
Main Tel: [insert general telephone]
E-mail: [insert general email], URL: [insert general telephone]Contact person’s name, position and contact details: …
EU Privacy Office (where relevant):
EU Representative (where relevant):
Description of processing (including a clear delimitation ofresponsibilities in case several sub-processors are authorised): …
2. …

ALNYLAM Proprietary and Confidential
Control Version Date 26.01.2021

9