European Union. Data localisation / cross-border. Commission Decision (standard contractual clauses)
EU SCCs 2002 (C2P)Commission Decision 2002/16/EC on standard contractual clauses for the transfer of personal data to processors established in third countries
§1Summary
- Synopsis
Decision 2002/16/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a processor in a third country. Decision 2010/87/EU repealed it with effect from 15 May 2010. Contracts concluded under it before that date remained in force and effect for as long as the transfers and processing stayed unchanged.
- Key themes
- Unique features
The first EU model clauses for processors outside the EU.
- SaaS relevance
Historical only; replaced by Decision 2010/87/EU, itself replaced in 2021.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Contractual safeguard for transfers to processors outside the EU
- Maximum penalty
- None
§3Dates
- Key dates
- Adopted
- In force
- Ended
- Adopted 27 December 2001; applied from 3 April 2002; repealed with effect from 15 May 2010 by Decision 2010/87/EU; contracts made before that date stayed valid while the processing remained unchanged
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- English text eur-lex.europa.eu
- Authority
- European Commission; national data protection authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Application date from Article 6 of the Decision; repeal from Article 7(1) of Decision 2010/87/EU.