Cross-Border Data Transfer Agreement (SCCs)

# Cross-Border Data Transfer Agreement (SCCs) This **Cross-Border Data Transfer Agreement** (this "Agreement"), incorporating the European Commission Standard Contractual Clauses for the transfer of personal data to third countries (Module Two: Controller to Processor) pursuant to Commission Implementing Decision (EU) 2021/914 (the "SCCs"), is entered into as of the date of last signature (the "Effective Date") by and between: **Data Exporter:** ___________, a ___________ established under the laws of ___________, with registered address at ___________ ("Data Exporter"); and **Data Importer:** ___________, a ___________ established under the laws of ___________, with registered address at ___________ ("Data Importer"). Each is a "Party"; together they are the "Parties." ## Part I — Main Agreement ### 1. Definitions 1.1 **"Applicable Data Protection Law"** means: (a) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") and any national law implementing or supplementing the GDPR; (b) the UK GDPR as defined in the Data Protection Act 2018 (to the extent applicable); and (c) any binding guidance, codes of conduct, or decisions of the European Data Protection Board or competent supervisory authority applicable to the transfer. 1.2 **"Controller,"** **"Processor,"** **"Data Subject,"** **"Personal Data,"** **"Personal Data Breach,"** **"Processing,"** **"Supervisory Authority,"** and **"Third Country"** have the meanings given to them in the GDPR. 1.3 **"Transfer"** means the onward transfer of Personal Data from the Data Exporter, established in the EEA (or subject to GDPR), to the Data Importer established in a Third Country that has not been the subject of an adequacy decision under Article 45 GDPR covering the relevant category of data transfer. 1.4 **"SCC Module Two"** means Module Two (Controller to Processor) of the Standard Contractual Clauses as set out in the Annex to Commission Implementing Decision (EU) 2021/914. ### 2. Incorporation of Standard Contractual Clauses 2.1 The Parties agree that the Transfers of Personal Data described in Annex I.B to this Agreement shall be subject to the SCC Module Two, which are incorporated herein by reference and form an integral part of this Agreement. In the event of any conflict between the general provisions of this Agreement and the SCCs, the SCCs shall prevail. 2.2 The Parties acknowledge that the SCCs are a legal requirement and their terms cannot be altered except as expressly permitted therein. ### 3. Data Exporter's Obligations 3.1 **Lawful basis.** Data Exporter confirms that it has a valid lawful basis under Article 6 GDPR (and, where applicable, Article 9 GDPR for special category data) for the initial processing and the Transfer of the Personal Data described in Annex I.B. 3.2 **Controller instructions.** Data Exporter shall document its processing instructions to Data Importer, shall ensure they are consistent with Applicable Data Protection Law, and shall promptly update them where required by law or practice. 3.3 **Data minimization.** Data Exporter shall transfer only the minimum categories and volumes of Personal Data necessary for the purposes described in Annex I.B. 3.4 **Data Subject information.** Data Exporter is responsible for informing Data Subjects, prior to or at the time of collection, of the Transfer and the identity of the Data Importer, to the extent required by Applicable Data Protection Law. 3.5 **Supervisory authority.** Data Exporter shall cooperate with and be subject to the jurisdiction of the supervisory authority specified in Annex I.C for the purpose of these SCCs.