SaaS suppliers and SaaS customers are increasingly relying upon the use of EU model clauses to enable them to lawfully export personal data outside of the EEA following the invalidity of Safe Harbor in 2016 and the current implementation of the EU-US Privacy Shield (which replaces Safe Harbor). SaaS customers often try to amend the terms of the EU model clauses when negotiating the SaaS agreement with the SaaS supplier. This can result in the EU model clauses being invalid as they do not provide adequate protection for the data transfer.
SaaS suppliers should therefore be aware of the risks of agreeing to any changes to EU model clause and know which changes are, and are not, permitted to ensure that they are not in breach of data protection laws. Continue reading