Tag: Bodle Law

SaaS Agreements – New EU and UK Laws Applicable to Online Platforms

Below is a summary of the following online platform laws:

that will impact SaaS suppliers and SaaS customers in 2026.

Some of these laws apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively). It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU Digital Services Act (DSA)

The DSA updates the E-Commerce Directive to increase online service provider’s obligations for their online platforms and content shared on them. Most provisions only apply to:

  • Very large online platforms, (VLOPs), e.g. Amazon, Apple; or
  • Search engines with an average monthly user base in the EU of more than 45 million people (VLOSEs), e.g. Bing, Google.

There are some exemptions for VLOPs and VLOSEs based upon numbers of employees and annual sales.

It is important to note that SaaS suppliers who are not VLOPs or VLOSEs could be subject to the DSA because they provide hosting services.

The DSA sets our mandatory obligations in respect of:

  • Illegal content – obligation to permit complaints and remove content;
  • Accountability – obligations to report on content moderation; and
  • Transparency – obligation to provide information on automatic decision making and content moderation.

The DSA applies to all intermediary services established in the EU and those with a “substantial connection” to the EU. A substantial connection can exist where numbers of recipients of the intermediary service in one or more EU Member States in relation to their population is large, or the SaaS supplier targets activities towards one or more EU Member States.

Non-compliance can result in fines of up to 6% of annual global turnover.

The DSA applies extra-territorially.

Non-EU entities subject to the DSA must appoint an EU Representative.

The EU European Accessibility Directive (EAA)

The EAA is an EU directive. Each EU Member State must pass its own local law to enact its provisions. The EAA aims to make certain types of products and services identified in the EAA more accessible to individuals with disabilities. For example: online banking services and ticket machines. There are no specific technical standards that a SaaS supplier whose products or services are caught by the EEA must comply with, but compliance with the Web Content Accessibility Guidelines (WCAG) web accessibility standards is advisable.

The EAA applies to SaaS suppliers with at least ten staff and a turnover of more than 2m Euros who sell relevant goods and services to consumers based in the EU, regardless of where the SaaS supplier is located.

The EAA is currently in force for some relevant goods and services placed on the EU market on, or after, the 28th of June 2025 and for all relevant goods and services regardless of when they were placed on the market from the 28th of June 2030.

The EAA applies extra-territorially.

The UK Online Safety Act (OSA)

The OSA is the UK’s own version of the DSA, but with significant differences. For example: with detailed measures on online child protections. The OSA applies to online search engines and user to user services that permit access to content generated or shared by other users, i.e. content-sharing platforms, social media platforms, online marketplaces, online gaming services, blogs, and forums.

OFCOM published a Children’s Safety Code of Practice in April 2024, (Code). Following the Code is not mandatory, but services applying the measures set out in the Code will be deemed to comply with their OSA obligations relating to children’s safety. Other compliance measures may be applied, but services will be required to demonstrate that any alternative measures match the standards set out in the Code.

The UK Digital Markets Competition and Consumers Act (DMCC)

The DMCC is a UK law that amends the Consumer Rights Act 2015. It mainly relates to consumer law in relation to drip pricing, fake reviews and has a list of blacklisted practices that will be deemed unfair under UK consumer law. The DMCC apples to companies operating in the UK, regardless of where they are incorporated, provided they have a global turnover of more than 25 billion or a UK turnover of more than 1 billion pounds Sterling.

Although this is a consumer law, the provisions could apply BTB, if the BTB relationship relates to the promotion or supply of products to consumers. For example: any product claims (i.e. green claims) that could be made by suppliers that are repeated to resellers, who sell to consumers.

Most of the DMCC consumer law provisions are already applicable, except for the new subscription contract rules, which will apply from Spring 2026. For example: providing certain pre-contract information, reminder notices and mechanisms for cancellation in consumer subscription contacts.

The CMA regulator can impose fines of up to 300,000 GBP or 10% of a company’s annual global turnover, whichever is higher, for breaches and the DMCC applies extra-territorially.

The Revised EU Product Liability Directive (PLD)

The PLD is an EU directive that will apply to all products (including software) placed on the EU market from the 9th of December 2026. Each EU Member State must pass its own national law to implement the PLD before the 9th of December 2026.

Software, firmware, applications, AI systems, and digital manufacturing files will become “products” and will be subject to the same strict liability regime as traditional physical goods.

The PLD will apply to integrated and interconnected digital services, such as “a health monitoring service that relies on a physical product’s sensors to track the user’s physical activity or health metrics”, smart products, IoT, automated vehicles, drones etc. when marketed in the EU.

From December 2026 any defect in software, including vulnerabilities or failures in digital services, may trigger strict liability under the PLD, if the defect causes harm.

The PLD will apply extra-territorially.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – New EU and UK Data Security Laws

Below is a summary of the following data security laws, the EU Network and Information Systems Directive 2, the EU Digital Operational Resilience Act, the EU Cyber Resilience Act, the EU Critical Entities Resilience Directive and the UK Product Security and Telecommunications Infrastructure Act that will impact SaaS suppliers and SaaS customers in 2026. Some of these laws apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively).

It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU Network and Information Systems Directive 2 (NIS2)

NIS2 applies to “in-scope entities” that operate in, or have critical infrastructure located in the EU. This EU directive only comes into effect in each EU Member State once each EU Member State passes their own national law implementing the directive. This mean that the laws in each EU Member State under NIS2 will differ.

To date only around 5 EU Member States have implemented NIS2 into their national laws. France and Germany for example have not implemented their new draft laws yet.

In-Scope Entities

NIS2 makes a distinction between “essential” and “important” entities based on:

  • The size of the entity; and
  • The sector in which they operate.

Essential Entities

Essential entities are large entities operating in highly critical sectors (as listed in Annex I of NIS2), summarised below:

  • Health;
  • Energy;
  • Transport;
  • Digital infrastructures;
  • Drinking water;
  • Banking;
  • Financial markets;
  • Waste water;
  • Space;
  • ICT service management; and
  • Public administration.

These entities are subject to more active regulatory oversight and stricter penalties for non-compliance.

Important Entities

Important entities are other medium and large entities operating in critical sectors (as listed in Annex II of NIS2), summarised below:

  • Digital providers of market places, search engines or social networking platforms;
  • Waste management;
  • Manufacturing;
  • Chemicals manufacture and distribution;
  • Postal services;
  • Food production and distribution; and
  • Research.

These entities are subject to regulatory interest if authorities become aware of non-compliance.

Exempted Entities

Small businesses (i.e. businesses with fewer than 50 employees and an annual turnover of less than 10m Euros) are exempted from NIS2, unless they operate in certain high critical sectors.

NIS2 is extra-territorial in relation to entities who have a significant presence, such as a trading legal entity, facilities, operations, or staff, in an EU country, or provide services to the EU market.

Non-EU entities subject to NIS2 must appoint an EU Representative.

ENISA has published voluntary technical guidance to support Member States and in-scope entities in implementing the technical and methodological requirements for cyber security risk management measures applying to critical entities under NIS2.

The EU Digital Operational Resilience Act (DORA)

Since the 17th of January 2025, DORA provisions must be included in contracts entered into between financial services entities subject to DORA and their third party providers of ICT Services. As SaaS suppliers are third party providers of digital and data services on an ongoing basis they will be third party providers of ICT services where their SaaS customers are regulated by DORA.

Both the SaaS customer and the SaaS supplier must comply with their applicable mandatory obligations under DORA.

How to assess DORA compliance

Where a SaaS supplier provides ICT services to any SaaS customers regulated by DORA, SaaS suppliers need to:

  • Identify whether or not they provide any “critical” or “important” services to such SaaS customers; and
  • Amend the terms of existing SaaS agreements with such SaaS customers, to include the relevant DORA provisions.

SaaS suppliers should ensure that any new obligations Customers try to add to SaaS agreements are limited to the mandatory requirements set out in DORA. Any obligations applicable to “critical” or “important” services, as these are defined by DORA, should not be added unless the SaaS supplier itself (not the SaaS customer) provides “critical” or “important” ICT services.

The EU Cyber Resilience Act (CRA)

The CRA establishes a minimum level of cyber security for all connected products available on the EU market. This new law applies in all EU Member States and will be implemented gradually.

Products covered by the CRA

All products sold in the EU that contain “digital elements” must meet the essential requirements of the CRA. This includes low-cost consumer products as well as B2B software and complex high-end industrial systems. “Products with digital elements” are defined in the CRA as products that can be connected to a device or a network and include both hardware products with networked functions (e.g. smartphones, laptops, smart home products, smart watches, internet connected toys, but also microprocessors, firewalls and smart meters) and pure software products (e.g. accounting software, computer games, mobile apps).

Non-commercial open source software products are exempt from the CRA and therefore do not have to fulfil the requirements of the CRA.

Manufacturers can be fined up to 15 million Euros or 2.5% of their total annual worldwide turnover, whichever is higher, for a breach.

The EU Critical Entities Resilience Directive (CER)

The CER applies to all critical entities that operate (e.g. provide services to individuals) within the EU, across 11 sectors. Member States must identify critical entities operating within their borders and designate a competent authority for enforcement of the CER by the 17th of July 2026.

The CER operates alongside NIS2 to enhance the resilience of critical entities in the EU to address the resilience of critical entities in respect of all hazards, going beyond cyber security to anticipate other natural, man-made, accidental, or intentional risks.

The CER does not differentiate between “essential” and “important” entities, using instead the general terminology of “critical entities” for providers of essential services.

Each EU Member State will determine penalties, which must be effective, proportionate, and dissuasive.

The CER does not apply to a SaaS supplier until they are identified as a critical entity by a Member State.

UK Product Security and Telecommunications Infrastructure (PSTI) Act – 29th April 2024

The PSTI is a UK law that governs the security of consumer connectable devices used or made available to UK consumers. The security measures of the PSTI apply to manufacturers, retailers, importers and distributors of connectable products and smart devices. The telecommunications infrastructure measures apply to network operators and infrastructure providers.

The PSTI outlines the types of products that may be “relevant connected products” which include:

  • “internet-connectable products” which means a product that is capable of connecting to the internet; and
  • “network-connectable products” which means a product that is: (i) capable of both sending and receiving data by means of a transmission involving electrical or electromagnetic energy; (ii) is not an internet-connectable product; and (iii) meets the first or second connectability condition.

“UK consumer connectable products”, are defined in clause 54 of the PSTI as a relevant connectable product which either:

  • Captures a product that is, or has been, available to UK consumers and has not been supplied by a relevant person to any customer (whether in the UK or not) at any time before being made so available (i.e. is not used at the point at which it is made available to customers) (Condition A); or
  • Is, or has been made available, to customers in the UK who are not consumers which has not been supplied by a relevant person to any customer (whether in the UK or not) at any time before being made so available (i.e. is not used at the point at which it is made available to customers) and where products identical to it meet Condition A (Condition B).

A product may therefore meet the definition of a UK consumer connectable product even if it is solely aimed at business customers. For example: if a smart camera is advertised to business users but not to consumers in the UK because the distributor is selling the camera only to businesses. However, if products identical to the smart camera (e.g. a smart camera of the same make and model) have been advertised (i.e. made available) to consumers in the UK by another distributor, the product would be considered a UK consumer connectable product, when made available by the distributor.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply. SaaS suppliers need to take action now to ensure their compliance with the above laws, as there are no grace periods for non-compliance.

rene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – New EU and UK Data Laws

Below is a summary of the EU Artificial Intelligence Act, the EU Data Act and the UK Data Use and Access Act that will impact SaaS suppliers and SaaS customers in 2026. These laws will apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively). It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU AI Act applies to AI systems and AI models and categorises AI systems into different risk categories.

The EU Artificial Intelligence Act (EU AI Act)

The four risk categories are:

  • Unacceptable risk systems – prohibited since the 2nd of February 2025 e.g. social scoring, crime prediction systems;
  • High Risk systems – subject to onerous requirements since August 2025 e.g. medical devices, education and recruitment systems;
  • Limited Risk systems – subject to transparency requirements from the 2nd of August 2026 e.g. GPAI systems; and
  • Minimal Risk systems – which are subject to some general requirements.

The provisions of the EU AI Act come into effect in phases, based upon the risk category of the AI system.

The EU AI Act applies to:

  • Providers who place AI systems on the market or put AI systems into service, or who place general purpose AI models (GPAI) on the market in the EU for example: ChatGPT, irrespective of where the provider is established or located;
  • Deployers of AI systems that are established or located within the EU;
  • Providers or deployers of AI systems that are established or located outside the EU, where output produced by the AI system is used in the EU;
  • Product manufacturers who place on the market or put into service an AI system together with their product, under their own name or trademark in the EU;
  • Authorised representatives of a provider not established in the EU; and
  • Affected persons located in the EU.

The European Commission has published Guidelines on prohibited artificial intelligence (AI) practices and Guidelines determining if a software system is an AI System to assist providers, deployers and other relevant persons in determining how the AI Act applies to them.

Breaches of the EU AI Act can result in fines of:

  • 35m Euros or 7% of annual global turnover for prohibited AI systems, whichever is higher;
  • 15m Euros or 3% of annual global turnover for general purpose AI (GPAI) systems, whichever is higher.

Each Member State must designate national competent authorities responsible for implementing the AI Act and conducting market surveillance.

The AI Act applies extra-territorially.

Non-EU entities subject to the AI Act who provide GPAI systems must appoint an EU Representative.

The EU Data Act (Data Act)

EU Data Act came into force on the 12th of September 2025.

The Data Act creates rights for individuals and businesses to access the personal and non-personal data produced through their use of smart objects, machines and connected devices. Users of connected devices have the right to access and share data they generate with third parties.

The Data Act also imposes BTB and BTC data sharing obligations on SaaS suppliers to enable easy cloud service switching. SaaS suppliers cannot impose, and must remove, pre-commercial, commercial, technical, contractual, and other barriers that inhibit customers from terminating contracts, porting data and digital assets, and (where technically feasible) unbundling infrastructure services from other types of data processing services.

The Data Act sets out clear rules and standards for ensuring interoperability across key sectors.

The Data Act impacts data holders, manufacturers of connected products or related services, users, data recipients and third parties and data processing providers globally.

Users and data recipients (who can be consumers or businesses) must be located in the EU for the Data Act to apply.

Switching Provisions

SaaS suppliers must now include mandatory contractual provisions in their SaaS agreements with customers to enable easy switching to a new SaaS provider. For example:

  • The customer’s right to terminate the SaaS agreement at any time, upon giving not more than 2 months notice;
  • Include a clear exit strategy;
  • Include clear cloud provider switching obligations;
  • Complete data export within 30 days of termination;
  • Guarantee deletion of exported data after 30 days;
  • All switching services must be provided free of charge from January 2027;
  • Data portability to be provided in standard formats. For example: ISO/IEC 19941:2017;
  • Publish security provisions; and
  • Promote interoperability.

The only exemptions to the above contractual provisions apply to services that are individually created specifically for a customer or services that are provided for testing purposes i.e. Beta services.

Each Member State must appoint competent authorities to ensure compliance with the provisions of the Data Act and those authorities will set penalties for non-compliance which should be effective, proportionate, and dissuasive. This means that each EU Member State will impose different levels of fines for breaches.

Internet of Things (IoT) Provisions

Where SaaS providers use connected products to provide their services (e.g. connected cars, medical devices, smart home devices) and related services (e.g. apps that control these products) users of the connected services have the right to access data generated by them using these products and services.

  • Data holders must allow direct or indirect access to such data;
  • Users may instruct a data holder to make data available to a third party i.e. another service provider, for which a reasonable fee can usually be charged;
  • Third parties are prohibited from using the data to create directly competing products; and
  • Trade secrets of data holders can be protected.

Non-compliance can result in fines of up to 4% of annual global turnover or 20m Euros, whichever is higher.

The Data Act applies extra-territorially.

Non-EU entities subject to the Data Act must appoint an EU Representative.

The UK Data Use and Access Act 2025 (DUAA)

DUUA brings specific sections of this new UK law into force in stages.

The changes made to date amend the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulation (PECR) as set out below.

PECR changes and Data Protection Law changes now in effect

The definition of “call” and “communication” in PECR, now includes all calls made and all communications transmitted, irrespective of whether they reach their intended recipient.

  • This is relevant for PECR direct marketing rules, as now an infringement of PECR can occur even if the call or communication did not reach the intended recipient; and
  • This will increase the level of the fine imposed.

Consent under PECR is now no longer needed but only in relation to UK data to:

  • Set cookies or use similar technologies to collect statistical information about how an organisation’s online services with the aim of improving the services;
  • Permit charities to send marketing materials for fundraising or to promote their charitable work to permit UK located individuals who have previously expressed an interest in their charitable purposes.

For more details on the changes the UK Government has published and will continue to publish factsheets on the Data (Use and Access) Act 2025.

PECR fines are now aligned with the Data Protection Act 2018 and UK GDPR fines, and can be imposed up to 17.5 million GBP.

Future changes

The majority of the changes made to UK Data Protection Law by DUAA, are not yet in effect and will be brought into effect by secondary legislation by the UK Government. The future changes will cover:

  • DSAR response protocols;
  • new rules on the use of automated decision making (ADM);
  • Exemptions to the need for consent, when using personal data for scientific research;
  • Creating a definition of “recognised legitimate interests” – which disposes of the need to carry out a legitimate interest assessment where the processing is carried out for a recognised legitimate interest;
  • Changes to the purpose limitation and clarification of what “further processing” means;
  • Changes to the rules on UK data exports to new third countries;
  • Changes to complaints handling procedures; and
  • Changes to the role of the ICO.

In light of the above changes to UK data protection law, the European Commission has only extended the current UK adequacy decision for international data transfers to the 31st of December 2025 – to allow the EC to assess the impact of DUAA on data transfers.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply. SaaS suppliers need to take action now to ensure their compliance with the above laws, as there are no grace periods for non-compliance and SaaS customers may start to try to exercise their statutory termination rights, switching rights and rights to data.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

FAQs – Sub-Processor Lists – Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully transfer personal data to sub-processors located outside of the UK, Switzerland or the EEA, (make a restricted transfer) if a recognised transfer mechanism is in place to protect the personal data being transferred.

Transfer Mechanisms

Currently the only transfer mechanisms are:

  • Adequacy, (EU Adequacy Decisions including the DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms are used, no restricted transfer of personal data can be lawfully made.

Adequacy

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay .

A full list can be found on the European Commission website – Adequacy Decisions.

Data Privacy Framework (DPF)

The DPF is an opt-in certification scheme that can be used with sub-processors located in the USA to enable restricted transfers of personal data to be lawfully made to the USA. The DPF has been in force since the 10th of July 2024 and US entities can apply to be certified on the DPF website. Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data relying upon the DPF.

EU + UK SCCs

EU standard contractual clauses are a set out of standard clauses that have been approved by the EU Commission as providing adequate protection, when used to transfer EU personal data from the EU to a third country located outside of the EEA. Up until June 2021 there were two sets of standard contractual clauses that could be used for transfers of personal data between data controllers, and one set for transfers between a data controller and a data processor, (old EU SCCs). There were no clauses for transfers between data processors.

In June 2021 the EU Commission replaced the old EU SCCs with one new set of standard contractual clauses, (new EU SCCs) to cover 4 different types of data transfers in one document in 4 different modules:

  • Module 1: covers transfers from a data controller (SaaS supplier) to a data controller outside of the EEA (third party);
  • Module 2: covers transfers from a data controller (SaaS customer) to a data processor outside of the EEA (SaaS supplier);
  • Module 3: covers transfers from a data processor (SaaS supplier) to a data processor outside of the EEA (sub-processor); and
  • Module 4: covers transfers from a data processor (SaaS supplier) to a data controller (third party) outside of the EEA.

Is important to be aware that when EU SCCs are relied upon as a data transfer mechanism a data transfer assessment must also be carried out.

Binding Corporate Rules (BCRs)

BCRs only cover international transfers of personal data between companies within the same group.

Sub-Processor Lists

SaaS suppliers must list all sub-processors to whom they transfer personal data, in a sub-processer list. The sub-processor list usually forms part of the SaaS supplier’s data processing agreement, (“DPA”) which is often published on the SaaS supplier’s website or SaaS platform. The transfer mechanism used by each sub-processor must be identified in the sub-processor list.

A SaaS supplier’s current list of sub-processors must correctly identify the actual transfer mechanism relied upon by each sub-processor. Please note that:

  • since the introduction of the DPF, many US sub-processors no longer user SCCs as their transfer mechanism; and
  •  where a sub-processor list was created before March 2024, the “old” EU and UK SCCs must be replaced with the “new” EU and UK SCCs.

SaaS suppliers should also be aware that where any sub-processor uses SCCs as a transfer mechanism, SaaS suppliers must ensure that the data transfer assessment carried out for each such sub-processor is updated at least annually.

Actions to be taken now

Where SaaS suppliers make any restricted transfers of personal data to sub-processors, or to their group companies, affiliates, customers or suppliers, they may need to update their legal documentation to reflect the above current transfer mechanisms.

For example:

Where a restricted transfer of personal data is made by the SaaS supplier to a member of a group company or an affiliate located in the USA the SaaS supplier will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the DPF rules;
  • amend any inter-company data processing agreements to reflect the new transfer mechanism.

Where a transfer of personal data is made to a customer, supplier or sub-processor located in the USA the SaaS supplier will need to:

  • amend its sub-processor list;
  • amend its data processing agreement;
  • amend its data transfer assessments;

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – DORA – ICT Supplier Obligations

SaaS suppliers obligations under the Digital Operational Resilience Act,(“DORA”), (Regulation (EU) 2022/2554 on digital operational resilience for the EU financial sector), are effective from the 17th of January 2025. From this date DORA provisions must be included in contracts entered into between financial services entities subject to DORA and their third party providers of ICT Services. As SaaS suppliers are third party providers of digital and data services on an ongoing basis they will be third party providers of ICT services if their SaaS customers are regulated by DORA. Both the SaaS customer and the SaaS supplier must comply with their applicable mandatory obligations under DORA.

Which entities does DORA apply to?

DORA applies directly to:

  • Any SaaS customers regulated by DORA; and
  • SaaS suppliers who provide “critical” or “important” ICT services to such SaaS customers.

DORA applies indirectly to SaaS suppliers who provide ICT Services to a SaaS customer regulated by DORA, as the SaaS customer must include certain mandatory provisions in their SaaS agreement with the SaaS supplier, in order for the SaaS customer to comply with its DORA obligations.

Does DORA only apply to EU entities?

DORA applies to:

  • Financial services SaaS customers located in the EU;
  • Financial services SaaS customers located outside the EU where the non-EU parent company enters into a contract with a SaaS supplier for provision of ICT services to any group entities within the scope of DORA (i.e. a global or master services agreement).

Penalties for breaches of DORA

Supervisory authorities can impose fines of up to 2% of global annual turnover for breaches of DORA. Local EU authorities can impose personal fines on the senior management and board members of a regulated entity of up to 1 million Euros.

Mandatory contractual terms

Article 30 of DORA sets out the mandatory contractual provisions that must be included in any SaaS agreement with a SaaS suppler who provides ICT services to a DORA regulated SaaS customer.

For all SaaS suppliers

Article 30(2)(a) – (i) of DORA set out the provisions applicable to all SaaS suppliers. These include:

  • An ICT services description;
  • Sub-contracting consents;
  • Services and data location information;
  • Data availability, integrity and data protection obligations;
  • Access to data;
  • Provision of free assistance if an ICT incident occurs;
  • Obligations to fully co-operate with appropriate regulators of the SaaS customer;
  • Specific termination rights;
  • Obligation to participate in the SaaS customer’s ICT security awareness programmes and digital operational resilience training.

For SaaS suppliers providing “critical or “important” ICT services

Article 30(3)(a) – (h) of DORA set out the additional provisions applicable to SaaS suppliers who provide “critical or “important” ICT services. These include :

  • Full service level descriptions;
  • Notice and reporting obligations;
  • Provision of business contingency plans;
  • Granting penetration testing rights;
  • Monitoring of SaaS supplier’s performance;
  • Unrestricted SaaS customer audit rights;
  • Comprehensive documented and tested exit arrangements, including provision of transitional and migration services.

How to assess DORA compliance

If you are a SaaS supplier who provides ICT services to any financial services SaaS customers regulated by DORA, you need to:

  • Check your existing customers to identify any financial services SaaS customers you provide ICT services to, who are regulated by DORA;
  • Identify whether or not your provide any “critical” or “important” services to such SaaS customers;
  • Amend the terms of your existing SaaS agreements with these SaaS customers, where you provide “critical” or “important” ICT services; and
  • When requested by a SaaS supplier to add any DORA amendments to a SaaS agreement, check that your new obligations are restricted to your mandatory requirements as a third party provider of ICT services as set out in Article 30 of DORA.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Restricted Transfers

Restricted transfers are a type of international data transfer to which special rules apply. SaaS suppliers and SaaS customers are responsible for complying with the relevant rules when making or permitting restricted transfers of personal data to their suppliers, customers, sub-processors, group companies and partners.

What is an international data transfer?

An international data transfer occurs when personal data is sent or transmitted from one country to another.

This includes:

  • sending personal data to an entity located in another country; and
  • making personal data available to an entity located in another country.

SaaS suppliers and SaaS customers should be aware that the storing or personal data in the UK/EEA i.e. in a data centre located in the UK, Switzerland or the EEA will not prevent a restricted transfer from taking place, unless the stored personal data cannot be accessed from, or sent to, an entity outside of the UK, Switzerland and the EEA.

What is a Restricted Transfer?

Examples of restricted transfers:

  • Emailing electronic documents containing personal data to another country
    i.e. using a third party email service
  • Sending electronic documents containing personal data to another country
    i.e. using a CRM SaaS service
  • Emailing records containing personal data to another country
    i.e. within a SaaS database
  • Allowing an entity based in another country access to documents or records containing personal data
    i.e. via a third party hosting centre
  • Allowing another entity in the same corporate group, based in another country access to UK/EU employee data
    i.e. for internal business purposes

Restricted Transfers from the EEA

The EU GDPR sets out the rules for making an international data transfer to an entity located outside the EEA. This is known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the EU GDPR , additional safeguards must be in place.

Restricted Transfers from the UK

The UK GDPR sets out the rules for making an international data transfer to an entity located outside the UK. This is also known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the UK GDPR, additional safeguards must be in place.

Who is responsible for a restricted transfer?

SaaS customers based in the UK, Switzerland or the EEA are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their SaaS suppliers, group companies, suppliers or partners.

SaaS suppliers (processors) subject to the EU GDPR or the UK GDPR are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their sub-processors, group companies, customers, suppliers or partners.

Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully make restricted transfers of UK, Swiss or EEA personal data if they use a recognized transfer mechanism.

Currently these are:

  • Adequacy, (EU Adequacy Decisions, DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms is used, no restricted transfer of personal data can be lawfully made.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Transfer Mechanisms

Below is a summary of the transfer mechanisms that can be relied upon to make a lawful transfer of UK, Swiss or EEA personal data to a country outside of the UK, Switzerland or the EEA.

Adequacy is granted when a recipient country is deemed to have data protection laws and practices similar to those of the sending country.

1. Adequacy Decisions

Restricted transfers can be made, without the need for any additional safeguards or measures to be put in place to protect the personal data, where personal data is sent to a country with an adequacy decision.

EU Transfers

EU Adequacy Decisions

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay.

UK, Japan, New Zealand, Uruguay and Switzerland. A full list can be found on the European Commission website – Adequacy Decisions.

EU-US Data Privacy Framework (DPF)

The European Commission agreed the DPF with the USA in July 2023 to permit restricted transfers of EEA personal data to from the EEA the USA. EEA personal data can be lawfully be transferred to organisations located in the USA that have been certified and meet the principles of the DPF.

Certification of any US entity can be checked via the DPF list.

UK Transfers

UK Adequacy Decisions

As a result of Brexit the UK awarded UK adequacy decisions to permit the transfer of personal data from the UK to:

  • the EEA; and
  • to any countries which covered by an EU Adequacy Decision.

This allows personal data to flow freely between the UK, the EEA and any countries awarded an EU Adequacy Decision.

Since Brexit, the UK Government has been granted its own powers to enter into UK Adequacy Decisions with countries that are outside of the EEA – but these only cover data being transferred from the UK.

One such UK Adequacy Decision has been granted to South Korea.

Currently the UK government is in discussions with the following countries for their own UK Adequacy Decisions:

  • Australia
  • Dubai
  • Kenya

UK-US Data Bridge

The UK government agreed its own transfer mechanism with the USA, the UK-US Data Bridge in September 2023. This will permit restricted transfers of UK personal data from the UK to the USA from the 12th October 2023.

Referred to by US authorities as the UK Extension to the DPF, entities based in the USA can sign up to the ‘UK Extension’ when registering under the DPF.

Certification of any US entity under the UK-US Data Bridge can be checked via the DPF list.

Swiss Transfers

Swiss-US Data Bridge

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged.

Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

2. Standard Contractual Clauses

EU Standard Contractual Clauses

In the absence of an EU Adequacy Decision, EU Standard Contractual Clauses (EU SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

UK Standard Contractual Clauses

In the absence of a UK Adequacy Decision, UK Standard Contractual Clauses (UK SCCs) can be used which the sender and the receiver of the personal data both sign up to. These contain mandatory contractual obligations designed to provide legal protection for personal data when transferred to a country that is not “adequate”.

Data Transfer Assessments

If a SaaS supplier or SaaS customer wishes to use EU SCCs or UK SCCs they must carry out a written data transfer assessment, (DTA) in order to determine whether personal data will be adequately protected. SCCs cannot be used unless such DTAs have been completed. In the EU the assessment is called a Transfer Impact Assessment, (TIA). In the UK, the assessment is called a Transfer Risk Assessment, (TRA).

3. Binding Corporate Rules (BCRs)

BCRs can be only used as a transfer mechanism for transfers of personal data between entities within a company group. Like SCCs, DTAs will need to be carried out where BCRs are relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: UK-US Data Bridge

On Friday the 22nd of September 2023, the UK agreed its own international data transfer mechanism with the USA to cover transfers of personal data from the UK to the USA. The new transfer mechanism can be used by SaaS companies from October, instead of UK standard contractual clauses.

From the 12 October 2023, SaaS Suppliers and SaaS Customers can start to transfer UK personal data to entities located in the USA provided that the US entity is certified under the new “UK Extension to the EU-US Data Privacy Framework” (UK-US Data Bridge).

This now means that all transfers of UK personal data made to US companies certified under the UK-US Data Bridge by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

What is the UK-US Data Bridge?

As result of Brexit, the UK was not included in the DPF as this only covers EU member states. The UK has therefore entered into its own agreement with the USA and this agreement is an extension to the DPF, known as the UK-US Data Bridge or the UK Extension. US organisations who have been certified to the DPF can opt in, to the UK Extension, to also receive personal data from the UK.

Once a US organisation has been certified and is publicly placed on the DPF List on the DPF website that includes the UK Extension, they can receive UK personal data through the UK-US Data Bridge.

The UK Extension of the DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The UK-US Data Bridge will be in force from the 12th of October and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List with the UK Extension included, they can receive UK personal data through the UK-US Data Bridge.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the UK-US Data Bridge.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the UK-US Data Bridge, however this must be correctly identified by UK organisations as such when it is being shared.

UK special category/sensitive personal data

Any UK personal data which is considered to be sensitive, and which is not covered by the definition applicable to EU personal data, it must be appropriately identified as sensitive to US organisations when transferred under the UK-US Data Bridge to ensure it receives appropriate protections.

This will include:

  • genetic data;
  • biometric data for the purpose of uniquely identifying a natural person;
  • data concerning sexual orientation

Where criminal offence data is proposed to be shared under the UK-US Data Bridge as part of a human resources (HR) data relationship, US recipient organisations are required to indicate that they are seeking to receive such data.

HR data is clarified under Human Resources Data Supplemental principle 9(a)(i) as:

  • personal information about its employees (past or present) collected in the context of the employment relationship [transferred] to a parent, affiliate, or unaffiliated service provider in the United States participating in the EU-US DPF.

Criminal offence data may also be shared outside of a HR relationship. When sharing criminal offence data it should be indicated to the US recipient organisation that it is sensitive data requiring additional protections, in line with protections for special category or sensitive data set out above.

UK Standard Contractual Clauses

Once a US entity is certified under the UK-US Data Bridge there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the UK-US Data Bridge to transfer UK personal data to the US for any reason, they will need to continue using UK standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the UK-US Data Bridge

SaaS suppliers should check that the recipient of the UK personal data is certified with the UK-US Data Bridge. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any UK personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of UK personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the UK-US Data Bridge;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of UK personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: EU-US Data Privacy Framework (DPF)

In July 2023 the EU-US Data Privacy Framework, (DPF) was finally agreed between the EU and the USA. The DPF now provides a new transfer mechanism for SaaS suppliers and SaaS customers to use when transferring EU personal data to the USA. The DPF can be used instead of EU standard contractual clauses.

This means that all transfers of EU personal data made to US companies certified under the DPF by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

What is the DPF

The DPF is an opt-in certification scheme that can be used by organisations located in the USA to enable EU personal data to be lawfully transferred to the USA. The DPF is enforced by the Federal Trade Commission (FTC) and Department of Transportation (DoT), and administered by the Department of Commerce (DoC).

The DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The DPF has been in force since the 10th of July and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the DPF.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the DPF.

EU special category/sensitive personal data

This covers personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual are considered sensitive information under the DPF. US organisations under the DPF are also required to treat as sensitive any information received which has been identified and previously been treated as sensitive by the organisation sharing the information.

EU Standard Contractual Clauses

Once a US entity is certified under the DPF there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

  • use EU standard contractual clauses to make transfers of personal data; or
  • carry out Schrems II data transfer assessments; or
  • check that additional safeguards are in place to protect the personal data transferred;

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the DPF to transfer EU personal data to the US for any reason, they will need to continue using EU standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the DPF

SaaS suppliers should check that the recipient of the EU personal data is certified with the DPF. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

  • the DPF; and
  • the UK Extension to the EU-US Data Privacy Framework.

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any EU personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of EU personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of EU personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Restricted Transfers

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

  • Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
  • Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
  • Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
  • Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

  • Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
  • EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

  • Implement supplemental safeguards when making restricted transfers; and
  • Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

  • Have in place supplemental measures; and
  • Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here