Model contract for transfers

Do you, as a company, want to transfer personal data from the EU to a third country (a country outside the EEA)? Then one of the options you have is using a model contract for this purpose. By using a model contract, you do not have to draw up such a contract yourself.

What is a model contract?

A model contract is a standard contract that has been approved by the European Commission (EC). The purpose of a model contract is the safe transfer of personal data to a third country. Using a model contract is not mandatory, but enables you to show that you meet the requirements of the privacy legislation.

Another name for a model contract is ‘standard contractual clauses’ (SCCs).

Note: Additional rules apply for transfers to the United States.

Use the new model contract

The EC has approved a new model contract. This applies as of 27 June 2021. The new model contract replaces the three earlier model contracts adopted by the EC. You can find the model contract at the end of the Implementation Decree (EU) 2021/914 of the EC.

Did you already use one or several model contracts as transfer tools before 27 June 2021? Then you will have until 27 December 2022 to adjust your present contract or contracts.

Modules in new model contract

The new model contract is more flexible than the old model contracts and deals with several situations. That is why several modules have been included in the document.

The new model contract consists of a general part and the following four modules:

transfers from controller to controller;
transfers from controller to processor;
transfers from (sub)processor to (sub)processor;
transfers from (sub)processor to controller.

Unmodified model contract

Do you use a model contract as it is, meaning without additions or modifications? Then you do not need permission from the Dutch Data Protection Authority (Dutch DPA) for your transfer.

Modified model contract or own contract

Do you want to use a model contract with additions or modifications? Or a contract of your own? Then you have to ask the Dutch DPA for permission for your transfer first.

Ask the Dutch DPA for permission

If you use a modified model contract or a contract of your own, you have to ask the Dutch DPA for permission for personal data transfers to a third country.

How the Dutch DPA assesses your application depends on your situation. There are two possible situations:

Model contract with additions. You use the model contract, but with additions. The Dutch DPA will only give its approval if the additional provisions do not conflict with the standard clauses in the model contract and/or the rights of data subjects. Are the additions in your application not in accordance with the model contract? Then you will be given the opportunity to adjust the clauses within a specified period of time.
Model contract with modifications or own contract. You use the model contract, but with modifications. Or you have drawn up your own contract. The specific circumstances of your transfer have been regulated in this contract. In this case, the Dutch DPA will have to assess the clauses thoroughly because they deviate from the model contract. You will be informed by the Dutch DPA about how long this will take.