Category: Data Protection

SaaS Agreements – New EU and UK Data Laws

Below is a summary of the EU Artificial Intelligence Act, the EU Data Act and the UK Data Use and Access Act that will impact SaaS suppliers and SaaS customers in 2026. These laws will apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively). It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU AI Act applies to AI systems and AI models and categorises AI systems into different risk categories.

The EU Artificial Intelligence Act (EU AI Act)

The four risk categories are:

  • Unacceptable risk systems – prohibited since the 2nd of February 2025 e.g. social scoring, crime prediction systems;
  • High Risk systems – subject to onerous requirements since August 2025 e.g. medical devices, education and recruitment systems;
  • Limited Risk systems – subject to transparency requirements from the 2nd of August 2026 e.g. GPAI systems; and
  • Minimal Risk systems – which are subject to some general requirements.

The provisions of the EU AI Act come into effect in phases, based upon the risk category of the AI system.

The EU AI Act applies to:

  • Providers who place AI systems on the market or put AI systems into service, or who place general purpose AI models (GPAI) on the market in the EU for example: ChatGPT, irrespective of where the provider is established or located;
  • Deployers of AI systems that are established or located within the EU;
  • Providers or deployers of AI systems that are established or located outside the EU, where output produced by the AI system is used in the EU;
  • Product manufacturers who place on the market or put into service an AI system together with their product, under their own name or trademark in the EU;
  • Authorised representatives of a provider not established in the EU; and
  • Affected persons located in the EU.

The European Commission has published Guidelines on prohibited artificial intelligence (AI) practices and Guidelines determining if a software system is an AI System to assist providers, deployers and other relevant persons in determining how the AI Act applies to them.

Breaches of the EU AI Act can result in fines of:

  • 35m Euros or 7% of annual global turnover for prohibited AI systems, whichever is higher;
  • 15m Euros or 3% of annual global turnover for general purpose AI (GPAI) systems, whichever is higher.

Each Member State must designate national competent authorities responsible for implementing the AI Act and conducting market surveillance.

The AI Act applies extra-territorially.

Non-EU entities subject to the AI Act who provide GPAI systems must appoint an EU Representative.

The EU Data Act (Data Act)

EU Data Act came into force on the 12th of September 2025.

The Data Act creates rights for individuals and businesses to access the personal and non-personal data produced through their use of smart objects, machines and connected devices. Users of connected devices have the right to access and share data they generate with third parties.

The Data Act also imposes BTB and BTC data sharing obligations on SaaS suppliers to enable easy cloud service switching. SaaS suppliers cannot impose, and must remove, pre-commercial, commercial, technical, contractual, and other barriers that inhibit customers from terminating contracts, porting data and digital assets, and (where technically feasible) unbundling infrastructure services from other types of data processing services.

The Data Act sets out clear rules and standards for ensuring interoperability across key sectors.

The Data Act impacts data holders, manufacturers of connected products or related services, users, data recipients and third parties and data processing providers globally.

Users and data recipients (who can be consumers or businesses) must be located in the EU for the Data Act to apply.

Switching Provisions

SaaS suppliers must now include mandatory contractual provisions in their SaaS agreements with customers to enable easy switching to a new SaaS provider. For example:

  • The customer’s right to terminate the SaaS agreement at any time, upon giving not more than 2 months notice;
  • Include a clear exit strategy;
  • Include clear cloud provider switching obligations;
  • Complete data export within 30 days of termination;
  • Guarantee deletion of exported data after 30 days;
  • All switching services must be provided free of charge from January 2027;
  • Data portability to be provided in standard formats. For example: ISO/IEC 19941:2017;
  • Publish security provisions; and
  • Promote interoperability.

The only exemptions to the above contractual provisions apply to services that are individually created specifically for a customer or services that are provided for testing purposes i.e. Beta services.

Each Member State must appoint competent authorities to ensure compliance with the provisions of the Data Act and those authorities will set penalties for non-compliance which should be effective, proportionate, and dissuasive. This means that each EU Member State will impose different levels of fines for breaches.

Internet of Things (IoT) Provisions

Where SaaS providers use connected products to provide their services (e.g. connected cars, medical devices, smart home devices) and related services (e.g. apps that control these products) users of the connected services have the right to access data generated by them using these products and services.

  • Data holders must allow direct or indirect access to such data;
  • Users may instruct a data holder to make data available to a third party i.e. another service provider, for which a reasonable fee can usually be charged;
  • Third parties are prohibited from using the data to create directly competing products; and
  • Trade secrets of data holders can be protected.

Non-compliance can result in fines of up to 4% of annual global turnover or 20m Euros, whichever is higher.

The Data Act applies extra-territorially.

Non-EU entities subject to the Data Act must appoint an EU Representative.

The UK Data Use and Access Act 2025 (DUAA)

DUUA brings specific sections of this new UK law into force in stages.

The changes made to date amend the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulation (PECR) as set out below.

PECR changes and Data Protection Law changes now in effect

The definition of “call” and “communication” in PECR, now includes all calls made and all communications transmitted, irrespective of whether they reach their intended recipient.

  • This is relevant for PECR direct marketing rules, as now an infringement of PECR can occur even if the call or communication did not reach the intended recipient; and
  • This will increase the level of the fine imposed.

Consent under PECR is now no longer needed but only in relation to UK data to:

  • Set cookies or use similar technologies to collect statistical information about how an organisation’s online services with the aim of improving the services;
  • Permit charities to send marketing materials for fundraising or to promote their charitable work to permit UK located individuals who have previously expressed an interest in their charitable purposes.

For more details on the changes the UK Government has published and will continue to publish factsheets on the Data (Use and Access) Act 2025.

PECR fines are now aligned with the Data Protection Act 2018 and UK GDPR fines, and can be imposed up to 17.5 million GBP.

Future changes

The majority of the changes made to UK Data Protection Law by DUAA, are not yet in effect and will be brought into effect by secondary legislation by the UK Government. The future changes will cover:

  • DSAR response protocols;
  • new rules on the use of automated decision making (ADM);
  • Exemptions to the need for consent, when using personal data for scientific research;
  • Creating a definition of “recognised legitimate interests” – which disposes of the need to carry out a legitimate interest assessment where the processing is carried out for a recognised legitimate interest;
  • Changes to the purpose limitation and clarification of what “further processing” means;
  • Changes to the rules on UK data exports to new third countries;
  • Changes to complaints handling procedures; and
  • Changes to the role of the ICO.

In light of the above changes to UK data protection law, the European Commission has only extended the current UK adequacy decision for international data transfers to the 31st of December 2025 – to allow the EC to assess the impact of DUAA on data transfers.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply. SaaS suppliers need to take action now to ensure their compliance with the above laws, as there are no grace periods for non-compliance and SaaS customers may start to try to exercise their statutory termination rights, switching rights and rights to data.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

FAQs – Sub-Processor Lists – Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully transfer personal data to sub-processors located outside of the UK, Switzerland or the EEA, (make a restricted transfer) if a recognised transfer mechanism is in place to protect the personal data being transferred.

Transfer Mechanisms

Currently the only transfer mechanisms are:

  • Adequacy, (EU Adequacy Decisions including the DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms are used, no restricted transfer of personal data can be lawfully made.

Adequacy

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay .

A full list can be found on the European Commission website – Adequacy Decisions.

Data Privacy Framework (DPF)

The DPF is an opt-in certification scheme that can be used with sub-processors located in the USA to enable restricted transfers of personal data to be lawfully made to the USA. The DPF has been in force since the 10th of July 2024 and US entities can apply to be certified on the DPF website. Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data relying upon the DPF.

EU + UK SCCs

EU standard contractual clauses are a set out of standard clauses that have been approved by the EU Commission as providing adequate protection, when used to transfer EU personal data from the EU to a third country located outside of the EEA. Up until June 2021 there were two sets of standard contractual clauses that could be used for transfers of personal data between data controllers, and one set for transfers between a data controller and a data processor, (old EU SCCs). There were no clauses for transfers between data processors.

In June 2021 the EU Commission replaced the old EU SCCs with one new set of standard contractual clauses, (new EU SCCs) to cover 4 different types of data transfers in one document in 4 different modules:

  • Module 1: covers transfers from a data controller (SaaS supplier) to a data controller outside of the EEA (third party);
  • Module 2: covers transfers from a data controller (SaaS customer) to a data processor outside of the EEA (SaaS supplier);
  • Module 3: covers transfers from a data processor (SaaS supplier) to a data processor outside of the EEA (sub-processor); and
  • Module 4: covers transfers from a data processor (SaaS supplier) to a data controller (third party) outside of the EEA.

Is important to be aware that when EU SCCs are relied upon as a data transfer mechanism a data transfer assessment must also be carried out.

Binding Corporate Rules (BCRs)

BCRs only cover international transfers of personal data between companies within the same group.

Sub-Processor Lists

SaaS suppliers must list all sub-processors to whom they transfer personal data, in a sub-processer list. The sub-processor list usually forms part of the SaaS supplier’s data processing agreement, (“DPA”) which is often published on the SaaS supplier’s website or SaaS platform. The transfer mechanism used by each sub-processor must be identified in the sub-processor list.

A SaaS supplier’s current list of sub-processors must correctly identify the actual transfer mechanism relied upon by each sub-processor. Please note that:

  • since the introduction of the DPF, many US sub-processors no longer user SCCs as their transfer mechanism; and
  •  where a sub-processor list was created before March 2024, the “old” EU and UK SCCs must be replaced with the “new” EU and UK SCCs.

SaaS suppliers should also be aware that where any sub-processor uses SCCs as a transfer mechanism, SaaS suppliers must ensure that the data transfer assessment carried out for each such sub-processor is updated at least annually.

Actions to be taken now

Where SaaS suppliers make any restricted transfers of personal data to sub-processors, or to their group companies, affiliates, customers or suppliers, they may need to update their legal documentation to reflect the above current transfer mechanisms.

For example:

Where a restricted transfer of personal data is made by the SaaS supplier to a member of a group company or an affiliate located in the USA the SaaS supplier will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the DPF rules;
  • amend any inter-company data processing agreements to reflect the new transfer mechanism.

Where a transfer of personal data is made to a customer, supplier or sub-processor located in the USA the SaaS supplier will need to:

  • amend its sub-processor list;
  • amend its data processing agreement;
  • amend its data transfer assessments;

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Restricted Transfers

Restricted transfers are a type of international data transfer to which special rules apply. SaaS suppliers and SaaS customers are responsible for complying with the relevant rules when making or permitting restricted transfers of personal data to their suppliers, customers, sub-processors, group companies and partners.

What is an international data transfer?

An international data transfer occurs when personal data is sent or transmitted from one country to another.

This includes:

  • sending personal data to an entity located in another country; and
  • making personal data available to an entity located in another country.

SaaS suppliers and SaaS customers should be aware that the storing or personal data in the UK/EEA i.e. in a data centre located in the UK, Switzerland or the EEA will not prevent a restricted transfer from taking place, unless the stored personal data cannot be accessed from, or sent to, an entity outside of the UK, Switzerland and the EEA.

What is a Restricted Transfer?

Examples of restricted transfers:

  • Emailing electronic documents containing personal data to another country
    i.e. using a third party email service
  • Sending electronic documents containing personal data to another country
    i.e. using a CRM SaaS service
  • Emailing records containing personal data to another country
    i.e. within a SaaS database
  • Allowing an entity based in another country access to documents or records containing personal data
    i.e. via a third party hosting centre
  • Allowing another entity in the same corporate group, based in another country access to UK/EU employee data
    i.e. for internal business purposes

Restricted Transfers from the EEA

The EU GDPR sets out the rules for making an international data transfer to an entity located outside the EEA. This is known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the EU GDPR , additional safeguards must be in place.

Restricted Transfers from the UK

The UK GDPR sets out the rules for making an international data transfer to an entity located outside the UK. This is also known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the UK GDPR, additional safeguards must be in place.

Who is responsible for a restricted transfer?

SaaS customers based in the UK, Switzerland or the EEA are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their SaaS suppliers, group companies, suppliers or partners.

SaaS suppliers (processors) subject to the EU GDPR or the UK GDPR are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their sub-processors, group companies, customers, suppliers or partners.

Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully make restricted transfers of UK, Swiss or EEA personal data if they use a recognized transfer mechanism.

Currently these are:

  • Adequacy, (EU Adequacy Decisions, DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms is used, no restricted transfer of personal data can be lawfully made.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Transfer Mechanisms

Below is a summary of the transfer mechanisms that can be relied upon to make a lawful transfer of UK, Swiss or EEA personal data to a country outside of the UK, Switzerland or the EEA.

Adequacy is granted when a recipient country is deemed to have data protection laws and practices similar to those of the sending country.

1. Adequacy Decisions

Restricted transfers can be made, without the need for any additional safeguards or measures to be put in place to protect the personal data, where personal data is sent to a country with an adequacy decision.

EU Transfers

EU Adequacy Decisions

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay.

UK, Japan, New Zealand, Uruguay and Switzerland. A full list can be found on the European Commission website – Adequacy Decisions.

EU-US Data Privacy Framework (DPF)

The European Commission agreed the DPF with the USA in July 2023 to permit restricted transfers of EEA personal data to from the EEA the USA. EEA personal data can be lawfully be transferred to organisations located in the USA that have been certified and meet the principles of the DPF.

Certification of any US entity can be checked via the DPF list.

UK Transfers

UK Adequacy Decisions

As a result of Brexit the UK awarded UK adequacy decisions to permit the transfer of personal data from the UK to:

  • the EEA; and
  • to any countries which covered by an EU Adequacy Decision.

This allows personal data to flow freely between the UK, the EEA and any countries awarded an EU Adequacy Decision.

Since Brexit, the UK Government has been granted its own powers to enter into UK Adequacy Decisions with countries that are outside of the EEA – but these only cover data being transferred from the UK.

One such UK Adequacy Decision has been granted to South Korea.

Currently the UK government is in discussions with the following countries for their own UK Adequacy Decisions:

  • Australia
  • Dubai
  • Kenya

UK-US Data Bridge

The UK government agreed its own transfer mechanism with the USA, the UK-US Data Bridge in September 2023. This will permit restricted transfers of UK personal data from the UK to the USA from the 12th October 2023.

Referred to by US authorities as the UK Extension to the DPF, entities based in the USA can sign up to the ‘UK Extension’ when registering under the DPF.

Certification of any US entity under the UK-US Data Bridge can be checked via the DPF list.

Swiss Transfers

Swiss-US Data Bridge

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged.

Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

2. Standard Contractual Clauses

EU Standard Contractual Clauses

In the absence of an EU Adequacy Decision, EU Standard Contractual Clauses (EU SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

UK Standard Contractual Clauses

In the absence of a UK Adequacy Decision, UK Standard Contractual Clauses (UK SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

Data Transfer Assessments

If a SaaS supplier or SaaS customer wishes to use EU SCCs or UK SCCs they must carry out a written data transfer assessment, (DTA) in order to determine whether personal data will be adequately protected. SCCs cannot be used unless such DTAs have been completed. In the EU the assessment is called a Transfer Impact Assessment, (TIA). In the UK, the assessment is called a Transfer Risk Assessment, (TRA).

3. Binding Corporate Rules (BCRs)

BCRs can be only used as a transfer mechanism for transfers of personal data between entities within a company group. Like SCCs, DTAs will need to be carried out where BCRs are relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: UK-US Data Bridge

On Friday the 22nd of September 2023, the UK agreed its own international data transfer mechanism with the USA to cover transfers of personal data from the UK to the USA. The new transfer mechanism can be used by SaaS companies from October, instead of UK standard contractual clauses.

From the 12 October 2023, SaaS Suppliers and SaaS Customers can start to transfer UK personal data to entities located in the USA provided that the US entity is certified under the new “UK Extension to the EU-US Data Privacy Framework” (UK-US Data Bridge).

This now means that all transfers of UK personal data made to US companies certified under the UK-US Data Bridge by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

What is the UK-US Data Bridge?

As result of Brexit, the UK was not included in the DPF as this only covers EU member states. The UK has therefore entered into its own agreement with the USA and this agreement is an extension to the DPF, known as the UK-US Data Bridge or the UK Extension. US organisations who have been certified to the DPF can opt in, to the UK Extension, to also receive personal data from the UK.

Once a US organisation has been certified and is publicly placed on the DPF List on the DPF website that includes the UK Extension, they can receive UK personal data through the UK-US Data Bridge.

The UK Extension of the DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The UK-US Data Bridge will be in force from the 12th of October and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List with the UK Extension included, they can receive UK personal data through the UK-US Data Bridge.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the UK-US Data Bridge.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the UK-US Data Bridge, however this must be correctly identified by UK organisations as such when it is being shared.

UK special category/sensitive personal data

Any UK personal data which is considered to be sensitive, and which is not covered by the definition applicable to EU personal data, it must be appropriately identified as sensitive to US organisations when transferred under the UK-US Data Bridge to ensure it receives appropriate protections.

This will include:

  • genetic data;
  • biometric data for the purpose of uniquely identifying a natural person;
  • data concerning sexual orientation

Where criminal offence data is proposed to be shared under the UK-US Data Bridge as part of a human resources (HR) data relationship, US recipient organisations are required to indicate that they are seeking to receive such data.

HR data is clarified under Human Resources Data Supplemental principle 9(a)(i) as:

  • personal information about its employees (past or present) collected in the context of the employment relationship [transferred] to a parent, affiliate, or unaffiliated service provider in the United States participating in the EU-US DPF.

Criminal offence data may also be shared outside of a HR relationship. When sharing criminal offence data it should be indicated to the US recipient organisation that it is sensitive data requiring additional protections, in line with protections for special category or sensitive data set out above.

UK Standard Contractual Clauses

Once a US entity is certified under the UK-US Data Bridge there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the UK-US Data Bridge to transfer UK personal data to the US for any reason, they will need to continue using UK standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the UK-US Data Bridge

SaaS suppliers should check that the recipient of the UK personal data is certified with the UK-US Data Bridge. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any UK personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of UK personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the UK-US Data Bridge;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of UK personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: EU-US Data Privacy Framework (DPF)

In July 2023 the EU-US Data Privacy Framework, (DPF) was finally agreed between the EU and the USA. The DPF now provides a new transfer mechanism for SaaS suppliers and SaaS customers to use when transferring EU personal data to the USA. The DPF can be used instead of EU standard contractual clauses.

This means that all transfers of EU personal data made to US companies certified under the DPF by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

What is the DPF

The DPF is an opt-in certification scheme that can be used by organisations located in the USA to enable EU personal data to be lawfully transferred to the USA. The DPF is enforced by the Federal Trade Commission (FTC) and Department of Transportation (DoT), and administered by the Department of Commerce (DoC).

The DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The DPF has been in force since the 10th of July and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the DPF.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the DPF.

EU special category/sensitive personal data

This covers personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual are considered sensitive information under the DPF. US organisations under the DPF are also required to treat as sensitive any information received which has been identified and previously been treated as sensitive by the organisation sharing the information.

EU Standard Contractual Clauses

Once a US entity is certified under the DPF there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

  • use EU standard contractual clauses to make transfers of personal data; or
  • carry out Schrems II data transfer assessments; or
  • check that additional safeguards are in place to protect the personal data transferred;

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the DPF to transfer EU personal data to the US for any reason, they will need to continue using EU standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the DPF

SaaS suppliers should check that the recipient of the EU personal data is certified with the DPF. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

  • the DPF; and
  • the UK Extension to the EU-US Data Privacy Framework.

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any EU personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of EU personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of EU personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Restricted Transfers

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

  • Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
  • Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
  • Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
  • Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

  • Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
  • EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

  • Implement supplemental safeguards when making restricted transfers; and
  • Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

  • Have in place supplemental measures; and
  • Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Does your DPA and Sub-Processor List need updating?

Meta were fined 1.2 billion Euros for breaches of EU data protection law and for transferring personal data of EU users to the US despite, using standard contractual clauses, (SCCs), having in place supplemental measures and carrying out data transfer impact assessments, (DTIAs). Google has also been pursued in various EU member states for similar breaches.

In light of these decisions, SaaS suppliers should review their own data protection practices and documentation to ensure that they are up to date and comply with the current rules.

Use of the correct SCCs

New EU SCCs

Since the 27th of December 2022 the new EU SCCs must be used for all transfers of EU personal data to a third country. Any SaaS agreements that still include the old EU SCCs must be updated to include the new EU SCCs.

New UK SCCs

All SaaS agreements concluded on or before the 21st of September 2022 must use the new UK SCCs.

SaaS suppliers and SaaS customers can only continue to use the old EU SCCs in existing SaaS agreements until the 21st of March 2024 provided that the processing operations that are the subject matter of the agreement remain unchanged.

Supplemental Measures

In addition to using the correct, and up to date SCCs, SaaS suppliers must carry out due diligence on any sub-processors they plan to use to process personal data, where the sub-processors rely upon SCCs to transfer personal data outside of the EEA. Details of the supplemental measures used must be included in the sub-processor list.

The only supplemental measures that are compliant with the European Data Protection Board, (EDPB) guidelines are:

  • Encryption of data at rest and in transit; and
  • Storage of encryption keys within the EEA.

Data Impact Transfer Assessments

Following the Schrems II decision, the court made clear that SaaS suppliers and SaaS customers must carry out and document data transfer impact assessments when using SCCs as a transfer mechanism for restricted transfers.

SaaS suppliers should check their Article 30 GDPR data mapping document to identify which sub-processors rely upon SCCs, then they must;

  • Carry out a Schrems II data transfer impact assessment, for each transfer from the EU;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (DTA) using the ICO tool or using an EU DTIA.

Summary

When reviewing compliance with the above rules SaaS suppliers and SaaS customers should not just check their SaaS agreements with customers. They will also need to review existing group data transfer agreements and existing agreements and DPAs with all third parties, i.e. suppliers, resellers, partners and sub-contractors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements: EU-US Adequacy Decision – Update

Following the Schrems II judgment, the EU-US Privacy Shield was declared invalid, meaning that SaaS suppliers and SaaS customers have to use standard contractual clauses (SCS) or BCRs when making transfers of EEA (or UK) personal data to the USA. In addition, SaaS customers and SaaS suppliers are required to carry out a data transfer impact assessment (DTIA) prior to transferring any personal data from the EEA or UK to a “third country” i.e. the USA.

New US Adequacy Decision

In December 2022, the European Commission published its draft adequacy decision for the new EU-US Data Privacy Framework (DPF). If the European Data Protection Board (EDPB), the EU Member States and the European Parliament approve the DPF, the USA will be granted adequacy by the EU Commission and SCCs and BCRs will no longer be required for transfers of EEA personal data to the USA.

The final adequacy decision of the EU Commission is expected to be made by July 2023.

Similar to the EU-US Privacy Shield, companies in the USA can choose to join the DPF and must commit to certain privacy obligations.

Unlike the EU-US Privacy Shield, the DPF now:

  • limits access to EEA personal data by US intelligence agencies to what is necessary and proportionate; and
  • provides an independent and impartial complaints mechanism and a Data Protection Review Court.

UK Adequacy Decision

The UK government intends to grant its own adequacy decision for the USA. However, it is likely that the content of a UK adequacy decision may differ from the EU’s adequacy decision.

Schrems Challenge

In light of recent comments made by Max Schrems on the DPF, it is very likely that Mr Schrems will challenge the validity of the DPF in the European Court of Justice on the basis that:

  • the US Data Protection Review Court does not adequately protect data subject’s rights; and
  • the scope of permitted surveillance by US authorities under the DPF is too wide.

If the DPF is challenged, any UK – US adequacy decision would probably also be challenged.

Advantages of using the DPF

If the DPF is granted “adequacy” by the European Commission, SaaS suppliers and SaaS customers can use the DPF instead of relying upon SCCs or BCRs. Furthermore, as the DPF will be recognised in the EU as a lawfully valid transfer mechanism for transfers of personal data to the USA (until declared otherwise by the ECJ). This means that there will be no need for SaaS suppliers and SaaS customers to carry out any data transfer impact assessments (DTIA) in addition.

A legal challenge to any EU-US adequacy decision would probably take a couple of years to be resolved, meaning once in place, the DPF can be used as a valid transfer mechanism for transfers to the USA in the near future, provided that an adequacy decision is issued by the EU Commission.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Retention and Deletion

GDPR Obligations

In compliance with their respective obligations under the GDPR, SaaS suppliers and SaaS customers must only keep personal data for as long as necessary and as specified to data subjects. SaaS suppliers should include their obligations in relation to retention and deletion of personal data when acting as a data processor in their SaaS agreement and when acting as a data controller in their privacy policy.

Data Retention Policy

In order to determine how long personal data should be kept, SaaS suppliers should create a data retention policy that identifies:

  • the types of personal data it processes; and
  • the purposes for which personal data are processed.

Once this information is collected, a SaaS supplier can then decide how long each type of personal data will be kept. The factors considered in determining retention periods should be recorded in the data retention policy. Exceptions should also be recorded, for example where any personal data may need to be held longer to comply with particular laws that apply to the SaaS supplier.

Personal data must then be deleted in accordance with the data retention policy.

When to Delete

Before a SaaS supplier deletes any personal data, they should:

  • identify the relevant personal data to be deleted;
  • consider whether any personal data needs to be kept for longer; and
  • decide whether the personal data should be permanently deleted or anonymised.

The date of deletion or anonymisation of the personal data should be recorded by the SaaS supplier so that evidence of the deletion can be produced, if required in a later dispute or if a disclosure request is made.

How to Delete

Any personal data must be securely deleted by the SaaS supplier. This includes backup copies of the personal data being deleted.

If any personal data needs to be retained for longer, such data should be anonymised where possible. SaaS suppliers must ensure that any personal data they use to create aggregated statistics or historical analysis is anonymised. Anonymisation means that all personal identifiers are removed from the data, so that is it truly anonymised i.e. it cannot identify an individual even if linked with other information. If truly anonymised, the GDPR does not apply to the date – as anonymised data is no longer personal data.

Remember: Pseudonymised data is still personal data – as individuals can be re-identified from this. The GDPR applies to pseudonymised data.

What to Delete

SaaS suppliers should physically destroy all physical records i.e. shredding or burning. A third party can be used for the destruction process, provided there is a data processing agreement in place between the SaaS supplier and the third party – as the third party will be the SaaS supplier’s processor.

Electronic records such as emails, text messages and recordings will also need to be destroyed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – EU Standard Contractual Clauses

SaaS Agreements – GDPR – Data Processing Agreement