Tag: software as a service

SaaS Agreements – New EU and UK Laws Applicable to Online Platforms

Below is a summary of the following online platform laws:

that will impact SaaS suppliers and SaaS customers in 2026.

Some of these laws apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively). It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU Digital Services Act (DSA)

The DSA updates the E-Commerce Directive to increase online service provider’s obligations for their online platforms and content shared on them. Most provisions only apply to:

  • Very large online platforms, (VLOPs), e.g. Amazon, Apple; or
  • Search engines with an average monthly user base in the EU of more than 45 million people (VLOSEs), e.g. Bing, Google.

There are some exemptions for VLOPs and VLOSEs based upon numbers of employees and annual sales.

It is important to note that SaaS suppliers who are not VLOPs or VLOSEs could be subject to the DSA because they provide hosting services.

The DSA sets our mandatory obligations in respect of:

  • Illegal content – obligation to permit complaints and remove content;
  • Accountability – obligations to report on content moderation; and
  • Transparency – obligation to provide information on automatic decision making and content moderation.

The DSA applies to all intermediary services established in the EU and those with a “substantial connection” to the EU. A substantial connection can exist where numbers of recipients of the intermediary service in one or more EU Member States in relation to their population is large, or the SaaS supplier targets activities towards one or more EU Member States.

Non-compliance can result in fines of up to 6% of annual global turnover.

The DSA applies extra-territorially.

Non-EU entities subject to the DSA must appoint an EU Representative.

The EU European Accessibility Directive (EAA)

The EAA is an EU directive. Each EU Member State must pass its own local law to enact its provisions. The EAA aims to make certain types of products and services identified in the EAA more accessible to individuals with disabilities. For example: online banking services and ticket machines. There are no specific technical standards that a SaaS supplier whose products or services are caught by the EEA must comply with, but compliance with the Web Content Accessibility Guidelines (WCAG) web accessibility standards is advisable.

The EAA applies to SaaS suppliers with at least ten staff and a turnover of more than 2m Euros who sell relevant goods and services to consumers based in the EU, regardless of where the SaaS supplier is located.

The EAA is currently in force for some relevant goods and services placed on the EU market on, or after, the 28th of June 2025 and for all relevant goods and services regardless of when they were placed on the market from the 28th of June 2030.

The EAA applies extra-territorially.

The UK Online Safety Act (OSA)

The OSA is the UK’s own version of the DSA, but with significant differences. For example: with detailed measures on online child protections. The OSA applies to online search engines and user to user services that permit access to content generated or shared by other users, i.e. content-sharing platforms, social media platforms, online marketplaces, online gaming services, blogs, and forums.

OFCOM published a Children’s Safety Code of Practice in April 2024, (Code). Following the Code is not mandatory, but services applying the measures set out in the Code will be deemed to comply with their OSA obligations relating to children’s safety. Other compliance measures may be applied, but services will be required to demonstrate that any alternative measures match the standards set out in the Code.

The UK Digital Markets Competition and Consumers Act (DMCC)

The DMCC is a UK law that amends the Consumer Rights Act 2015. It mainly relates to consumer law in relation to drip pricing, fake reviews and has a list of blacklisted practices that will be deemed unfair under UK consumer law. The DMCC apples to companies operating in the UK, regardless of where they are incorporated, provided they have a global turnover of more than 25 billion or a UK turnover of more than 1 billion pounds Sterling.

Although this is a consumer law, the provisions could apply BTB, if the BTB relationship relates to the promotion or supply of products to consumers. For example: any product claims (i.e. green claims) that could be made by suppliers that are repeated to resellers, who sell to consumers.

Most of the DMCC consumer law provisions are already applicable, except for the new subscription contract rules, which will apply from Spring 2026. For example: providing certain pre-contract information, reminder notices and mechanisms for cancellation in consumer subscription contacts.

The CMA regulator can impose fines of up to 300,000 GBP or 10% of a company’s annual global turnover, whichever is higher, for breaches and the DMCC applies extra-territorially.

The Revised EU Product Liability Directive (PLD)

The PLD is an EU directive that will apply to all products (including software) placed on the EU market from the 9th of December 2026. Each EU Member State must pass its own national law to implement the PLD before the 9th of December 2026.

Software, firmware, applications, AI systems, and digital manufacturing files will become “products” and will be subject to the same strict liability regime as traditional physical goods.

The PLD will apply to integrated and interconnected digital services, such as “a health monitoring service that relies on a physical product’s sensors to track the user’s physical activity or health metrics”, smart products, IoT, automated vehicles, drones etc. when marketed in the EU.

From December 2026 any defect in software, including vulnerabilities or failures in digital services, may trigger strict liability under the PLD, if the defect causes harm.

The PLD will apply extra-territorially.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – New EU and UK Data Security Laws

Below is a summary of the following data security laws, the EU Network and Information Systems Directive 2, the EU Digital Operational Resilience Act, the EU Cyber Resilience Act, the EU Critical Entities Resilience Directive and the UK Product Security and Telecommunications Infrastructure Act that will impact SaaS suppliers and SaaS customers in 2026. Some of these laws apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively).

It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU Network and Information Systems Directive 2 (NIS2)

NIS2 applies to “in-scope entities” that operate in, or have critical infrastructure located in the EU. This EU directive only comes into effect in each EU Member State once each EU Member State passes their own national law implementing the directive. This mean that the laws in each EU Member State under NIS2 will differ.

To date only around 5 EU Member States have implemented NIS2 into their national laws. France and Germany for example have not implemented their new draft laws yet.

In-Scope Entities

NIS2 makes a distinction between “essential” and “important” entities based on:

  • The size of the entity; and
  • The sector in which they operate.

Essential Entities

Essential entities are large entities operating in highly critical sectors (as listed in Annex I of NIS2), summarised below:

  • Health;
  • Energy;
  • Transport;
  • Digital infrastructures;
  • Drinking water;
  • Banking;
  • Financial markets;
  • Waste water;
  • Space;
  • ICT service management; and
  • Public administration.

These entities are subject to more active regulatory oversight and stricter penalties for non-compliance.

Important Entities

Important entities are other medium and large entities operating in critical sectors (as listed in Annex II of NIS2), summarised below:

  • Digital providers of market places, search engines or social networking platforms;
  • Waste management;
  • Manufacturing;
  • Chemicals manufacture and distribution;
  • Postal services;
  • Food production and distribution; and
  • Research.

These entities are subject to regulatory interest if authorities become aware of non-compliance.

Exempted Entities

Small businesses (i.e. businesses with fewer than 50 employees and an annual turnover of less than 10m Euros) are exempted from NIS2, unless they operate in certain high critical sectors.

NIS2 is extra-territorial in relation to entities who have a significant presence, such as a trading legal entity, facilities, operations, or staff, in an EU country, or provide services to the EU market.

Non-EU entities subject to NIS2 must appoint an EU Representative.

ENISA has published voluntary technical guidance to support Member States and in-scope entities in implementing the technical and methodological requirements for cyber security risk management measures applying to critical entities under NIS2.

The EU Digital Operational Resilience Act (DORA)

Since the 17th of January 2025, DORA provisions must be included in contracts entered into between financial services entities subject to DORA and their third party providers of ICT Services. As SaaS suppliers are third party providers of digital and data services on an ongoing basis they will be third party providers of ICT services where their SaaS customers are regulated by DORA.

Both the SaaS customer and the SaaS supplier must comply with their applicable mandatory obligations under DORA.

How to assess DORA compliance

Where a SaaS supplier provides ICT services to any SaaS customers regulated by DORA, SaaS suppliers need to:

  • Identify whether or not they provide any “critical” or “important” services to such SaaS customers; and
  • Amend the terms of existing SaaS agreements with such SaaS customers, to include the relevant DORA provisions.

SaaS suppliers should ensure that any new obligations Customers try to add to SaaS agreements are limited to the mandatory requirements set out in DORA. Any obligations applicable to “critical” or “important” services, as these are defined by DORA, should not be added unless the SaaS supplier itself (not the SaaS customer) provides “critical” or “important” ICT services.

The EU Cyber Resilience Act (CRA)

The CRA establishes a minimum level of cyber security for all connected products available on the EU market. This new law applies in all EU Member States and will be implemented gradually.

Products covered by the CRA

All products sold in the EU that contain “digital elements” must meet the essential requirements of the CRA. This includes low-cost consumer products as well as B2B software and complex high-end industrial systems. “Products with digital elements” are defined in the CRA as products that can be connected to a device or a network and include both hardware products with networked functions (e.g. smartphones, laptops, smart home products, smart watches, internet connected toys, but also microprocessors, firewalls and smart meters) and pure software products (e.g. accounting software, computer games, mobile apps).

Non-commercial open source software products are exempt from the CRA and therefore do not have to fulfil the requirements of the CRA.

Manufacturers can be fined up to 15 million Euros or 2.5% of their total annual worldwide turnover, whichever is higher, for a breach.

The EU Critical Entities Resilience Directive (CER)

The CER applies to all critical entities that operate (e.g. provide services to individuals) within the EU, across 11 sectors. Member States must identify critical entities operating within their borders and designate a competent authority for enforcement of the CER by the 17th of July 2026.

The CER operates alongside NIS2 to enhance the resilience of critical entities in the EU to address the resilience of critical entities in respect of all hazards, going beyond cyber security to anticipate other natural, man-made, accidental, or intentional risks.

The CER does not differentiate between “essential” and “important” entities, using instead the general terminology of “critical entities” for providers of essential services.

Each EU Member State will determine penalties, which must be effective, proportionate, and dissuasive.

The CER does not apply to a SaaS supplier until they are identified as a critical entity by a Member State.

UK Product Security and Telecommunications Infrastructure (PSTI) Act – 29th April 2024

The PSTI is a UK law that governs the security of consumer connectable devices used or made available to UK consumers. The security measures of the PSTI apply to manufacturers, retailers, importers and distributors of connectable products and smart devices. The telecommunications infrastructure measures apply to network operators and infrastructure providers.

The PSTI outlines the types of products that may be “relevant connected products” which include:

  • “internet-connectable products” which means a product that is capable of connecting to the internet; and
  • “network-connectable products” which means a product that is: (i) capable of both sending and receiving data by means of a transmission involving electrical or electromagnetic energy; (ii) is not an internet-connectable product; and (iii) meets the first or second connectability condition.

“UK consumer connectable products”, are defined in clause 54 of the PSTI as a relevant connectable product which either:

  • Captures a product that is, or has been, available to UK consumers and has not been supplied by a relevant person to any customer (whether in the UK or not) at any time before being made so available (i.e. is not used at the point at which it is made available to customers) (Condition A); or
  • Is, or has been made available, to customers in the UK who are not consumers which has not been supplied by a relevant person to any customer (whether in the UK or not) at any time before being made so available (i.e. is not used at the point at which it is made available to customers) and where products identical to it meet Condition A (Condition B).

A product may therefore meet the definition of a UK consumer connectable product even if it is solely aimed at business customers. For example: if a smart camera is advertised to business users but not to consumers in the UK because the distributor is selling the camera only to businesses. However, if products identical to the smart camera (e.g. a smart camera of the same make and model) have been advertised (i.e. made available) to consumers in the UK by another distributor, the product would be considered a UK consumer connectable product, when made available by the distributor.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply. SaaS suppliers need to take action now to ensure their compliance with the above laws, as there are no grace periods for non-compliance.

rene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – New EU and UK Data Laws

Below is a summary of the EU Artificial Intelligence Act, the EU Data Act and the UK Data Use and Access Act that will impact SaaS suppliers and SaaS customers in 2026. These laws will apply extra-territorially, meaning the laws apply even when a SaaS supplier is not located in the UK or the EU (respectively). It is important to be aware of these new laws in order to assess whether or not they apply to your particular SaaS business, products and services.

The EU AI Act applies to AI systems and AI models and categorises AI systems into different risk categories.

The EU Artificial Intelligence Act (EU AI Act)

The four risk categories are:

  • Unacceptable risk systems – prohibited since the 2nd of February 2025 e.g. social scoring, crime prediction systems;
  • High Risk systems – subject to onerous requirements since August 2025 e.g. medical devices, education and recruitment systems;
  • Limited Risk systems – subject to transparency requirements from the 2nd of August 2026 e.g. GPAI systems; and
  • Minimal Risk systems – which are subject to some general requirements.

The provisions of the EU AI Act come into effect in phases, based upon the risk category of the AI system.

The EU AI Act applies to:

  • Providers who place AI systems on the market or put AI systems into service, or who place general purpose AI models (GPAI) on the market in the EU for example: ChatGPT, irrespective of where the provider is established or located;
  • Deployers of AI systems that are established or located within the EU;
  • Providers or deployers of AI systems that are established or located outside the EU, where output produced by the AI system is used in the EU;
  • Product manufacturers who place on the market or put into service an AI system together with their product, under their own name or trademark in the EU;
  • Authorised representatives of a provider not established in the EU; and
  • Affected persons located in the EU.

The European Commission has published Guidelines on prohibited artificial intelligence (AI) practices and Guidelines determining if a software system is an AI System to assist providers, deployers and other relevant persons in determining how the AI Act applies to them.

Breaches of the EU AI Act can result in fines of:

  • 35m Euros or 7% of annual global turnover for prohibited AI systems, whichever is higher;
  • 15m Euros or 3% of annual global turnover for general purpose AI (GPAI) systems, whichever is higher.

Each Member State must designate national competent authorities responsible for implementing the AI Act and conducting market surveillance.

The AI Act applies extra-territorially.

Non-EU entities subject to the AI Act who provide GPAI systems must appoint an EU Representative.

The EU Data Act (Data Act)

EU Data Act came into force on the 12th of September 2025.

The Data Act creates rights for individuals and businesses to access the personal and non-personal data produced through their use of smart objects, machines and connected devices. Users of connected devices have the right to access and share data they generate with third parties.

The Data Act also imposes BTB and BTC data sharing obligations on SaaS suppliers to enable easy cloud service switching. SaaS suppliers cannot impose, and must remove, pre-commercial, commercial, technical, contractual, and other barriers that inhibit customers from terminating contracts, porting data and digital assets, and (where technically feasible) unbundling infrastructure services from other types of data processing services.

The Data Act sets out clear rules and standards for ensuring interoperability across key sectors.

The Data Act impacts data holders, manufacturers of connected products or related services, users, data recipients and third parties and data processing providers globally.

Users and data recipients (who can be consumers or businesses) must be located in the EU for the Data Act to apply.

Switching Provisions

SaaS suppliers must now include mandatory contractual provisions in their SaaS agreements with customers to enable easy switching to a new SaaS provider. For example:

  • The customer’s right to terminate the SaaS agreement at any time, upon giving not more than 2 months notice;
  • Include a clear exit strategy;
  • Include clear cloud provider switching obligations;
  • Complete data export within 30 days of termination;
  • Guarantee deletion of exported data after 30 days;
  • All switching services must be provided free of charge from January 2027;
  • Data portability to be provided in standard formats. For example: ISO/IEC 19941:2017;
  • Publish security provisions; and
  • Promote interoperability.

The only exemptions to the above contractual provisions apply to services that are individually created specifically for a customer or services that are provided for testing purposes i.e. Beta services.

Each Member State must appoint competent authorities to ensure compliance with the provisions of the Data Act and those authorities will set penalties for non-compliance which should be effective, proportionate, and dissuasive. This means that each EU Member State will impose different levels of fines for breaches.

Internet of Things (IoT) Provisions

Where SaaS providers use connected products to provide their services (e.g. connected cars, medical devices, smart home devices) and related services (e.g. apps that control these products) users of the connected services have the right to access data generated by them using these products and services.

  • Data holders must allow direct or indirect access to such data;
  • Users may instruct a data holder to make data available to a third party i.e. another service provider, for which a reasonable fee can usually be charged;
  • Third parties are prohibited from using the data to create directly competing products; and
  • Trade secrets of data holders can be protected.

Non-compliance can result in fines of up to 4% of annual global turnover or 20m Euros, whichever is higher.

The Data Act applies extra-territorially.

Non-EU entities subject to the Data Act must appoint an EU Representative.

The UK Data Use and Access Act 2025 (DUAA)

DUUA brings specific sections of this new UK law into force in stages.

The changes made to date amend the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulation (PECR) as set out below.

PECR changes and Data Protection Law changes now in effect

The definition of “call” and “communication” in PECR, now includes all calls made and all communications transmitted, irrespective of whether they reach their intended recipient.

  • This is relevant for PECR direct marketing rules, as now an infringement of PECR can occur even if the call or communication did not reach the intended recipient; and
  • This will increase the level of the fine imposed.

Consent under PECR is now no longer needed but only in relation to UK data to:

  • Set cookies or use similar technologies to collect statistical information about how an organisation’s online services with the aim of improving the services;
  • Permit charities to send marketing materials for fundraising or to promote their charitable work to permit UK located individuals who have previously expressed an interest in their charitable purposes.

For more details on the changes the UK Government has published and will continue to publish factsheets on the Data (Use and Access) Act 2025.

PECR fines are now aligned with the Data Protection Act 2018 and UK GDPR fines, and can be imposed up to 17.5 million GBP.

Future changes

The majority of the changes made to UK Data Protection Law by DUAA, are not yet in effect and will be brought into effect by secondary legislation by the UK Government. The future changes will cover:

  • DSAR response protocols;
  • new rules on the use of automated decision making (ADM);
  • Exemptions to the need for consent, when using personal data for scientific research;
  • Creating a definition of “recognised legitimate interests” – which disposes of the need to carry out a legitimate interest assessment where the processing is carried out for a recognised legitimate interest;
  • Changes to the purpose limitation and clarification of what “further processing” means;
  • Changes to the rules on UK data exports to new third countries;
  • Changes to complaints handling procedures; and
  • Changes to the role of the ICO.

In light of the above changes to UK data protection law, the European Commission has only extended the current UK adequacy decision for international data transfers to the 31st of December 2025 – to allow the EC to assess the impact of DUAA on data transfers.

Actions to Take Now

There are a lot of new EU and UK laws now in force, coming into force in stages or into force in the next 18 months that could affect SaaS Suppliers.

After considering the above summary, SaaS suppliers need to consider which of the above laws do, could, or may, apply to their products and services that they supply or the sectors in which they their business operates. This will depend upon numerous different factors for each law, such as:

  • The location of the SaaS supplier;
  • The location of customers, suppliers, data holders;
  • Whether services are provided BTB or BTC;
  • The global turnover of the SaaS supplier;
  • The sector in which the SaaS supplier operates;
  • The types of services being provided by the SaaS supplier;
  • The sector in which the SaaS customer operates;
  • Whether or not IoT services are provided; and
  • The specific EU country in which the SaaS supplier, its customers or the services are being made available.

Each of the above laws will need to be assessed separately to determine if, and how, they apply. SaaS suppliers need to take action now to ensure their compliance with the above laws, as there are no grace periods for non-compliance and SaaS customers may start to try to exercise their statutory termination rights, switching rights and rights to data.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – DORA – ICT Supplier Obligations

SaaS suppliers obligations under the Digital Operational Resilience Act,(“DORA”), (Regulation (EU) 2022/2554 on digital operational resilience for the EU financial sector), are effective from the 17th of January 2025. From this date DORA provisions must be included in contracts entered into between financial services entities subject to DORA and their third party providers of ICT Services. As SaaS suppliers are third party providers of digital and data services on an ongoing basis they will be third party providers of ICT services if their SaaS customers are regulated by DORA. Both the SaaS customer and the SaaS supplier must comply with their applicable mandatory obligations under DORA.

Which entities does DORA apply to?

DORA applies directly to:

  • Any SaaS customers regulated by DORA; and
  • SaaS suppliers who provide “critical” or “important” ICT services to such SaaS customers.

DORA applies indirectly to SaaS suppliers who provide ICT Services to a SaaS customer regulated by DORA, as the SaaS customer must include certain mandatory provisions in their SaaS agreement with the SaaS supplier, in order for the SaaS customer to comply with its DORA obligations.

Does DORA only apply to EU entities?

DORA applies to:

  • Financial services SaaS customers located in the EU;
  • Financial services SaaS customers located outside the EU where the non-EU parent company enters into a contract with a SaaS supplier for provision of ICT services to any group entities within the scope of DORA (i.e. a global or master services agreement).

Penalties for breaches of DORA

Supervisory authorities can impose fines of up to 2% of global annual turnover for breaches of DORA. Local EU authorities can impose personal fines on the senior management and board members of a regulated entity of up to 1 million Euros.

Mandatory contractual terms

Article 30 of DORA sets out the mandatory contractual provisions that must be included in any SaaS agreement with a SaaS suppler who provides ICT services to a DORA regulated SaaS customer.

For all SaaS suppliers

Article 30(2)(a) – (i) of DORA set out the provisions applicable to all SaaS suppliers. These include:

  • An ICT services description;
  • Sub-contracting consents;
  • Services and data location information;
  • Data availability, integrity and data protection obligations;
  • Access to data;
  • Provision of free assistance if an ICT incident occurs;
  • Obligations to fully co-operate with appropriate regulators of the SaaS customer;
  • Specific termination rights;
  • Obligation to participate in the SaaS customer’s ICT security awareness programmes and digital operational resilience training.

For SaaS suppliers providing “critical or “important” ICT services

Article 30(3)(a) – (h) of DORA set out the additional provisions applicable to SaaS suppliers who provide “critical or “important” ICT services. These include :

  • Full service level descriptions;
  • Notice and reporting obligations;
  • Provision of business contingency plans;
  • Granting penetration testing rights;
  • Monitoring of SaaS supplier’s performance;
  • Unrestricted SaaS customer audit rights;
  • Comprehensive documented and tested exit arrangements, including provision of transitional and migration services.

How to assess DORA compliance

If you are a SaaS supplier who provides ICT services to any financial services SaaS customers regulated by DORA, you need to:

  • Check your existing customers to identify any financial services SaaS customers you provide ICT services to, who are regulated by DORA;
  • Identify whether or not your provide any “critical” or “important” services to such SaaS customers;
  • Amend the terms of your existing SaaS agreements with these SaaS customers, where you provide “critical” or “important” ICT services; and
  • When requested by a SaaS supplier to add any DORA amendments to a SaaS agreement, check that your new obligations are restricted to your mandatory requirements as a third party provider of ICT services as set out in Article 30 of DORA.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Restricted Transfers

Restricted transfers are a type of international data transfer to which special rules apply. SaaS suppliers and SaaS customers are responsible for complying with the relevant rules when making or permitting restricted transfers of personal data to their suppliers, customers, sub-processors, group companies and partners.

What is an international data transfer?

An international data transfer occurs when personal data is sent or transmitted from one country to another.

This includes:

  • sending personal data to an entity located in another country; and
  • making personal data available to an entity located in another country.

SaaS suppliers and SaaS customers should be aware that the storing or personal data in the UK/EEA i.e. in a data centre located in the UK, Switzerland or the EEA will not prevent a restricted transfer from taking place, unless the stored personal data cannot be accessed from, or sent to, an entity outside of the UK, Switzerland and the EEA.

What is a Restricted Transfer?

Examples of restricted transfers:

  • Emailing electronic documents containing personal data to another country
    i.e. using a third party email service
  • Sending electronic documents containing personal data to another country
    i.e. using a CRM SaaS service
  • Emailing records containing personal data to another country
    i.e. within a SaaS database
  • Allowing an entity based in another country access to documents or records containing personal data
    i.e. via a third party hosting centre
  • Allowing another entity in the same corporate group, based in another country access to UK/EU employee data
    i.e. for internal business purposes

Restricted Transfers from the EEA

The EU GDPR sets out the rules for making an international data transfer to an entity located outside the EEA. This is known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the EU GDPR , additional safeguards must be in place.

Restricted Transfers from the UK

The UK GDPR sets out the rules for making an international data transfer to an entity located outside the UK. This is also known as a “restricted transfer”.

In order for a restricted transfer to be lawful under the UK GDPR, additional safeguards must be in place.

Who is responsible for a restricted transfer?

SaaS customers based in the UK, Switzerland or the EEA are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their SaaS suppliers, group companies, suppliers or partners.

SaaS suppliers (processors) subject to the EU GDPR or the UK GDPR are responsible for making sure additional safeguards are in place before making restricted transfers of UK, Swiss or EEA personal data to their sub-processors, group companies, customers, suppliers or partners.

Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully make restricted transfers of UK, Swiss or EEA personal data if they use a recognized transfer mechanism.

Currently these are:

  • Adequacy, (EU Adequacy Decisions, DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms is used, no restricted transfer of personal data can be lawfully made.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: UK-US Data Bridge

On Friday the 22nd of September 2023, the UK agreed its own international data transfer mechanism with the USA to cover transfers of personal data from the UK to the USA. The new transfer mechanism can be used by SaaS companies from October, instead of UK standard contractual clauses.

From the 12 October 2023, SaaS Suppliers and SaaS Customers can start to transfer UK personal data to entities located in the USA provided that the US entity is certified under the new “UK Extension to the EU-US Data Privacy Framework” (UK-US Data Bridge).

This now means that all transfers of UK personal data made to US companies certified under the UK-US Data Bridge by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

What is the UK-US Data Bridge?

As result of Brexit, the UK was not included in the DPF as this only covers EU member states. The UK has therefore entered into its own agreement with the USA and this agreement is an extension to the DPF, known as the UK-US Data Bridge or the UK Extension. US organisations who have been certified to the DPF can opt in, to the UK Extension, to also receive personal data from the UK.

Once a US organisation has been certified and is publicly placed on the DPF List on the DPF website that includes the UK Extension, they can receive UK personal data through the UK-US Data Bridge.

The UK Extension of the DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The UK-US Data Bridge will be in force from the 12th of October and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List with the UK Extension included, they can receive UK personal data through the UK-US Data Bridge.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the UK-US Data Bridge.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the UK-US Data Bridge, however this must be correctly identified by UK organisations as such when it is being shared.

UK special category/sensitive personal data

Any UK personal data which is considered to be sensitive, and which is not covered by the definition applicable to EU personal data, it must be appropriately identified as sensitive to US organisations when transferred under the UK-US Data Bridge to ensure it receives appropriate protections.

This will include:

  • genetic data;
  • biometric data for the purpose of uniquely identifying a natural person;
  • data concerning sexual orientation

Where criminal offence data is proposed to be shared under the UK-US Data Bridge as part of a human resources (HR) data relationship, US recipient organisations are required to indicate that they are seeking to receive such data.

HR data is clarified under Human Resources Data Supplemental principle 9(a)(i) as:

  • personal information about its employees (past or present) collected in the context of the employment relationship [transferred] to a parent, affiliate, or unaffiliated service provider in the United States participating in the EU-US DPF.

Criminal offence data may also be shared outside of a HR relationship. When sharing criminal offence data it should be indicated to the US recipient organisation that it is sensitive data requiring additional protections, in line with protections for special category or sensitive data set out above.

UK Standard Contractual Clauses

Once a US entity is certified under the UK-US Data Bridge there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the UK-US Data Bridge to transfer UK personal data to the US for any reason, they will need to continue using UK standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the UK-US Data Bridge

SaaS suppliers should check that the recipient of the UK personal data is certified with the UK-US Data Bridge. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any UK personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of UK personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the UK-US Data Bridge;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of UK personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection: EU-US Data Privacy Framework (DPF)

In July 2023 the EU-US Data Privacy Framework, (DPF) was finally agreed between the EU and the USA. The DPF now provides a new transfer mechanism for SaaS suppliers and SaaS customers to use when transferring EU personal data to the USA. The DPF can be used instead of EU standard contractual clauses.

This means that all transfers of EU personal data made to US companies certified under the DPF by SaaS companies will be deemed to be to a third country that has adequate data protection laws.

What is the DPF

The DPF is an opt-in certification scheme that can be used by organisations located in the USA to enable EU personal data to be lawfully transferred to the USA. The DPF is enforced by the Federal Trade Commission (FTC) and Department of Transportation (DoT), and administered by the Department of Commerce (DoC).

The DPF contains enforceable principles and requirements that must be certified to, and complied with, in order for a US organisation to be able to join the DPF. These principles take the form of commitments to data protection and govern how US organisations use, collect and disclose personal data.

The DPF has been in force since the 10th of July and US entities can apply to be certified on the DPF website.

Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data through the DPF.

Which US organisations can certify under the DPF?

Only US organisations subject to the jurisdiction of the FTC or the DoT are currently eligible to participate in the DPF program. Those US organisations not subject to the jurisdiction of either the FTC or DoT — for example, banking, insurance, and telecommunications companies — are unable to participate in the DPF program at this time.

Data excluded from transfers under the DPF

Journalistic data defined by Supplemental Principle 2(b) of the DPF is not subject to the requirements of the DPF. Therefore, such data cannot be transferred under the DPF.

Rules applicable to special category data

Special category and sensitive data can be shared with US organisations under the DPF.

EU special category/sensitive personal data

This covers personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual are considered sensitive information under the DPF. US organisations under the DPF are also required to treat as sensitive any information received which has been identified and previously been treated as sensitive by the organisation sharing the information.

EU Standard Contractual Clauses

Once a US entity is certified under the DPF there is no longer any legal requirement for SaaS suppliers or SaaS customers to:

  • use EU standard contractual clauses to make transfers of personal data; or
  • carry out Schrems II data transfer assessments; or
  • check that additional safeguards are in place to protect the personal data transferred;

as such transfers will be deemed to be to an entity located in a third country that has adequate data protection laws.

However, if a SaaS company cannot rely on the DPF to transfer EU personal data to the US for any reason, they will need to continue using EU standard contractual clauses or Binding Corporate Rules (BCRs) for such transfers to the USA. The requirement to carry out Schrems II data transfer assessments in addition will also continue.

What about Switzerland?

The Swiss Data Protection Authority is currently finalising the provisions of a parallel framework between Switzerland and the USA (The Swiss-US Data Privacy Framework). However, until the new Swiss-US Data Privacy Framework is finalized, Switzerland’s adequacy list will remain unchanged. Pursuant to the new Swiss Data Protection Act of the 1st of September 2023 the Swiss Federal Council has authority to decide on the adequacy of states and it will be up to the Swiss Federal Council to determine whether the USA can be added to the list in due course.

How to check registration under the DPF

SaaS suppliers should check that the recipient of the EU personal data is certified with the DPF. Certification can be checked on the DPF website.

It is important to check that the US organisation has signed up to both:

  • the DPF; and
  • the UK Extension to the EU-US Data Privacy Framework.

If any HR data will be transferred to the US organization:

  • the certification of the US organisation on the DPF website must highlight this; and
  • there must be a link in the company’s certification on the DPF website to the relevant privacy policy or policies (for HR data and/or non-HR data) under the “Privacy Policy” section of the record.

Actions to be taken now

Where SaaS companies transfer any EU personal data to their group companies, affiliates, customers, suppliers or sub-processors located in the USA they will need to update their legal documentation to reflect these changes.

Where a transfer of EU personal data is made to a member of a group company or affiliate located in the USA they will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the certification rules;
  • amend intercompany data processing agreements to reflect the new transfer mechanism.

Where a transfer of EU personal data is made to a customer, supplier or sub-processor located in the USA they will need to:

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Retention and Deletion

GDPR Obligations

In compliance with their respective obligations under the GDPR, SaaS suppliers and SaaS customers must only keep personal data for as long as necessary and as specified to data subjects. SaaS suppliers should include their obligations in relation to retention and deletion of personal data when acting as a data processor in their SaaS agreement and when acting as a data controller in their privacy policy.

Data Retention Policy

In order to determine how long personal data should be kept, SaaS suppliers should create a data retention policy that identifies:

  • the types of personal data it processes; and
  • the purposes for which personal data are processed.

Once this information is collected, a SaaS supplier can then decide how long each type of personal data will be kept. The factors considered in determining retention periods should be recorded in the data retention policy. Exceptions should also be recorded, for example where any personal data may need to be held longer to comply with particular laws that apply to the SaaS supplier.

Personal data must then be deleted in accordance with the data retention policy.

When to Delete

Before a SaaS supplier deletes any personal data, they should:

  • identify the relevant personal data to be deleted;
  • consider whether any personal data needs to be kept for longer; and
  • decide whether the personal data should be permanently deleted or anonymised.

The date of deletion or anonymisation of the personal data should be recorded by the SaaS supplier so that evidence of the deletion can be produced, if required in a later dispute or if a disclosure request is made.

How to Delete

Any personal data must be securely deleted by the SaaS supplier. This includes backup copies of the personal data being deleted.

If any personal data needs to be retained for longer, such data should be anonymised where possible. SaaS suppliers must ensure that any personal data they use to create aggregated statistics or historical analysis is anonymised. Anonymisation means that all personal identifiers are removed from the data, so that is it truly anonymised i.e. it cannot identify an individual even if linked with other information. If truly anonymised, the GDPR does not apply to the date – as anonymised data is no longer personal data.

Remember: Pseudonymised data is still personal data – as individuals can be re-identified from this. The GDPR applies to pseudonymised data.

What to Delete

SaaS suppliers should physically destroy all physical records i.e. shredding or burning. A third party can be used for the destruction process, provided there is a data processing agreement in place between the SaaS supplier and the third party – as the third party will be the SaaS supplier’s processor.

Electronic records such as emails, text messages and recordings will also need to be destroyed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – EU Standard Contractual Clauses

SaaS Agreements – GDPR – Data Processing Agreement

SaaS Agreements – Data Protection – New EU Standard Contractual Clauses

The new EU Standard Contractual Clauses (new SCCs) must now be used by all SaaS suppliers and SaaS customers who transfer personal data from the EU to countries outside the EU/EEA (third countries) as the old SCCs (old SCCs) were repealed on the 27th of September 2021. Below is a summary of the changes and measures that SaaS suppliers and SaaS customers need to take to adapt and implement the new SCCs.

What are EU Standard Contractual Clauses

EU standard contractual clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection for the transfer of personal data from the EEA to a third country – known as a restricted transfer. Until the 27th of September 2021 there were two sets of standard contractual clauses: (i) for transfers of personal data between data controllers; and (ii) for transfers between a data controller and a data processor.

New SCCs must be used where EU personal data is transferred from:

  • A data controller (SaaS customer) to a data processor (SaaS supplier) located outside of the EEA; or
  • A SaaS supplier (data processor) transfes EU personal data to a sub-processor located outside of the EEA;

The SaaS supplier will need to enter into the new SCCs with the SaaS customer or SaaS sub-processor, as applicable.

When must the new SCCs be used?

From the 27th of September 2021 all new data processing agreements with customers and suppliers (including inter-company agreements) must use the new SCCs. SaaS suppliers and SaaS customers can continue using the old SCCs for existing agreements until the 27th of December 2022. On or before the 27th of December 2022 all old SCCs must be replaced with the new SCCs.

How are the new SCCs different?

The new SCCs cover 4 different types of transfers:

  • controller to controller;
  • controller to processor;
  • processor to processor;
  • processor to controller.

SaaS suppliers and SaaS customers must adapt and customise the 4 modules as required for each customer, supplier or inter-company data transfer, as applicable.

No separate DPA required

The new SCCs include all of the provisions that must be included in a written data processing agreement under Article 28 of the GDPR. This means that the new SCCs can be used without the need for any additional DPA. However, SaaS suppliers and SaaS customers should still have an overarching data transfer agreement that the new SCCs form a part of, in appropriate cases, as the new SCCs have very onerous provisions that should only apply to transfers of EU personal data.

Obligations of the Parties

Each of the 4 modules sets out the different data protection obligations of the parties which will need to be customised for each applicable module, or deleted if a module does not apply.

Security Measures

Specific technical and organisational measures (TOMs) must be described in Annex II of the new SCCS, clearly indicating which specific measures apply to each transfer.

Competent Supervisory Authority

The data importer agrees to accept the authority of the competent data protection authority named in Annex I of the new SCCs, respond to its enquiries, comply with the measures adopted by the data protection authority and submit to audits by the data protection authority.

The data protection authority of the data exporter, not the data importer will be the competent supervisory authority.

Where the data exporter is not located in the EU, but is subject to the GDPR the supervisory authority will be that of:

  •  the country in which the data exporter’s EU representative is established; or
  • the EU country in which the data subjects whose personal data is transferred are located, where no EU representative is required under the GDPR.

Local Law Assessment and Documentation – Schrems II

The data exporter and data importer must warrant that they have completed a data transfer assessment (DTA) of the local laws in the third country to which EU personal data will be transferred, where SCCs (of BCRs) are relied upon as the lawful basis for the transfer. They must also warrant that they have no reason to believe that such laws would prevent the importer from complying with their obligations under the new SCCs.

The parties must document this DTA (known as a “Schrems II assessment”) and make the DTA available on request, to a data protection supervisory authority.

Access by Public Authorities

Data importers must comply with the contractual obligations set out in the new SCCs if they receive a binding request from a public authority for disclosure of personal data. This includes notifying the data exporter, documenting responses and requests, providing periodic reporting to the data exporter, and challenging requests, if the data importer determines that any access request is unlawful.

Third Party Beneficiaries

Data subjects can make direct claims and complaints against the data importer for breaches of the new SCCs.

Liability

The data exporter and data importer are jointly and severally liable for breaches of the new SCCs. Each party is also liable to the other and data subjects for breaches of the new SCCs.

Onward Transfers

These are only permitted where the third party receiving the personal data signs the new SCCs or is established in a country that is “adequate”, such as the UK.

What about the UK

The new SCCs cannot be used for UK personal data. The old SCCs adapted by the UK Data Commissioner(ICO) must be used in relation to all UK personal data.

Implementing the New SCCs

In order to implement the new SCCs SaaS suppliers and SaaS customers need to:

  • carry out a data mapping exercise to identify all personal data transfers;
  • carry out and document a Schrems II data transfer assessment for each transfer using SCCs or BCRs;
  • review and amend their technical and organisational measures used for protecting personal data transferred to third countries;
  • identify and review all existing contracts and template agreements that involve the transfer of EU personal data to a third country;
  • amend all exisitng DPAs to incoporate the new SCCs;
  • adapt and customise the new SCCs and their Annexes for transfers to and from customers, suppliers and inter-group companies;
  • use the new SCCs for all new contracts entered in from 27th of September 2021;
  • replace the old SCCS with the new SCCS in all existing contracts by the 27th of December 2022.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – US Companies

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR does not just apply to SaaS suppliers and SaaS customers located in the EU. The GDPR also applies outside the EU, i.e. to SaaS suppliers and SaaS customers located in the USA and other non-EU countries.

GDPR Applies to US SaaS Customers and SaaS Suppliers

The GDPR will apply to SaaS suppliers and SaaS customers located in the USA if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier or SaaS Customer is not located within the EU.

US SaaS suppliers and US SaaS customers must therefore comply with the provisions of the GDPR from the 25th of May 2018.

Offering Goods or Services

In order for a US SaaS customer or supplier to be deemed to be offering SaaS goods or services it must be clear that the US company envisages offering SaaS goods or services to data subjects in one or more EU countries. This will be determined by looking at:

  • The use of any country specific domain names, e.g. co.uk;
  • The languages in which goods or services are offered, e.g. French;
  • The currencies in which goods or services are offered e.g. Euros.

Monitoring Behaviour of EU Data Subjects

In order for a US SaaS customer or supplier to be deemed to be monitoring the behaviour of EU data subjects, this will be the case if you track individuals on the Internet for profiling purposes, e.g. through the use of cookies.

Fines for Non-compliance

Data subjects will be able to claim damages directly from SaaS suppliers or SaaS customers who breach any obligations under the GDPR.

In addition data protection authorities will be able to fine SaaS suppliers and/or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

How to Comply

US SaaS customers and SaaS suppliers need to take the following actions to comply with the GDPR by the 25th of May 2018:

  • Identify what personal data of data subjects located in the EU they collect/process;
  • Review and amend SaaS agreement terms for compliance with the GDPR;
  • Create GDPR compliant data processing agreements (DPA);
  • Amend existing privacy policies to comply with the GDPR;
  • Implement the security, technical and administrative changes required to comply with the GDPR and set out in the above legal documentation.

NB/ US SaaS customers or SaaS suppliers who do not, or cannot, comply with the GDPR, should enact measures to prevent orders being placed on their websites by EU data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: