SaaS Agreements – Data Protection – Amending EU Model Clauses

SaaS suppliers and SaaS customers are increasingly relying upon the use of EU model clauses to enable them to lawfully export personal data outside of the EEA following the invalidity of Safe Harbor in 2016 and the current implementation of the EU-US Privacy Shield (which replaces Safe Harbor). SaaS customers often try to amend the terms of the EU model clauses when negotiating the SaaS agreement with the SaaS supplier. This can result in the EU model clauses being invalid as they do not provide adequate protection for the data transfer.

SaaS suppliers should therefore be aware of the risks of agreeing to any changes to EU model clause and know which changes are, and are not, permitted to ensure that they are not in breach of data protection laws.

Continue reading

SaaS Agreements – Data Protection – SaaS, Brexit and the GDPR

UK SaaS suppliers must currently comply with the terms of the Data Protection Act 1998 (DPA), which governs data protection law in the UK. SaaS suppliers should be aware that from the 25th of May 2018, the General Data Protection Regulation (GDPR) will apply directly in all Member States of the European Union (EU).

Many SaaS suppliers are concerned about their data protection obligations following Brexit and are unaware that they will still have obligations (as data processors) to comply with the new rules imposed by the GDPR, even after a Brexit.

Continue reading

SaaS Agreements – Data Protection – New obligations for SaaS Customers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR will place further more onerous obligations on SaaS customers (data controllers) in relation to all data processing. SaaS customers need to amend the terms of their existing SaaS agreements and privacy policies and implement the changes into internal policies and procedures in order to comply with the upcoming changes in UK data protection law.

Continue reading

SaaS Agreements – Data Protection – New Obligations for SaaS Suppliers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers) and their clients (data subjects) will be able to enforce breaches of the new rules directly against SaaS suppliers. SaaS suppliers need to amend the terms of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Continue reading

SaaS Agreements – Data Protection – Cyber Insurance

Currently most SaaS suppliers and SaaS customers do not take put specific cyber insurance and rely upon the provisions of a general insurance policy to cover liabilities in the event of a claim for a cyber incident or a data breach. This is partly due to the fact that few insurers offer adequate cyber insurance policies and SaaS customer and SaaS supplier’s failure to consider the need for a specialist policy of insurance, to ensure that they are covered in the event of a claim being denied under a general insurance policy.

Continue reading

SaaS Agreements – Data Protection – Privacy Shield Update

Similar to the rules under the Safe Harbor scheme, SaaS customer and SaaS suppliers need to self-certify their compliance with the principles of the Privacy Shield. The following are the core principles which must be adhered to.
Core Principles

Notice must be given to data subjects about specific issues;
Choice to opt out of disclosure of data to third parties;
Accountability for onward transfer to third parties;

Continue reading

SaaS Agreements – Data Protection – Microsoft Irish Data Centre Decision

Many SaaS customers are concerned whne using data centres which are owned by a US parent company i.e. Microsoft or Amazon, that even if their SaaS data is stored in a data centre located in the EU it will not be protected against disclosure to US authorities. The recent US court of appeal ruling won by Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, can prevent US authorities from accessing their data in some circumstances.

Continue reading

SaaS Agreements – Data Protection – Privacy Shield Approved

EU data protection law prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position following the recent announcement that the EU-US Privacy Shield has been adopted by the EU Commission and will now replace Safe Harbor.

Continue reading

SaaS Agreements – Data Protection – Brexit and the GDPR

SaaS suppliers and customers must currently comply with the terms of the Data Protection Act 1998 (DPA) which governs data protection law in the UK. SaaS suppliers and SaaS customers should be aware that from the 25th of May 2018, the General Data Protection Regulation (GDPR) will apply directly in all Member States of the European Union (EU). Currently the UK is a Member State of the EU and even if the UK gives the European Council notice of its intention to leave the EU, it has 2 years in which to negotiate the terms of a “Brexit”. It is therefore likely that the UK will still be part of the EU on the 25th of May 2018

Continue reading

SaaS Agreements – FAQs – EU Model Clauses

EU model clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection. There are currently two sets of standard contractual clauses for transfers of personal data between data controllers and one set for transfers between a data controller and a data processor. EU model clauses must be used unamended (other than where specific details may be added, as set out in the notes to the clauses).

Where personal data is transferred from:

a data controller in the EU (SaaS customer) to a data processor outside of the EEA (SaaS supplier); or
a SaaS supplier within the EU to a sub-processor located outside of the EEA;

the SaaS supplier will need to enter into EU model clauses with the SaaS customer or SaaS sub-processor, as applicable.

Continue reading
Bodle Law