European Union. Data localisation / cross-border. Commission Decision (standard contractual clauses)
EU SCCs 2001 (C2C)Commission Decision 2001/497/EC on standard contractual clauses for the transfer of personal data to third countries (controller to controller)
§1Summary
- Synopsis
Decision 2001/497/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a controller in a third country. Decision 2004/915/EC added an alternative second set of clauses from 1 April 2005. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
- Key themes
- Unique features
The first set of EU standard contractual clauses. Decision 2004/915/EC let exporters choose between two sets of clauses.
- SaaS relevance
Historical only; replaced by the 2021 standard contractual clauses (Decision (EU) 2021/914).
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Contractual safeguard for transfers outside the EU
- Maximum penalty
- None
§3Dates
- Key dates
- Adopted
- In force
- Ended
- Adopted 15 June 2001; applied from 3 September 2001; amended by Decision 2004/915/EC (alternative set of clauses, applied from 1 April 2005); repealed with effect from 27 September 2021 by Decision (EU) 2021/914; contracts signed before that date remained valid until 27 December 2022
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- English text eur-lex.europa.eu
- Authority
- European Commission; national data protection authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Date of application from Article 6 of the Decision; repeal and transitional dates from Article 4 of Decision 2021/914.