MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
If you transfer personal data to a country outside the EEA (a “third country”), you must properly substantiate that transfer. This is often done using the European Commission’s standard contractual clauses (model contract). The old model contracts have been replaced by new, GDPR-compliant versions that take the Schrems II ruling into account. If you use these unchanged, you do not need permission from the DPA; however, you do for modifications.
Companies that transfer personal data to a country outside the EEA may need to update their agreement — due to Brexit, this also applies to transfers to the United Kingdom. (This post dates from 2021; the switch to the new model contract had to be completed by the end of 2022 at the latest and is now mandatory.)
Transfer to third countries
The GDPR sets strict rules for transfers to third countries — non-EU countries, with the exception of Iceland, Norway, and Liechtenstein (which, as EEA countries, offer an equivalent level of protection). General rule: you may only transfer to countries with an adequate level of protection. If you transfer to an EEA country, only the general GDPR requirements apply.
If a country does not offer an adequate level of protection, transfer is only permitted on a lawful basis. One example is transfer to substantiate a legal claim, but most entrepreneurs rely on “adequate safeguards”: you guarantee the security of the data yourself. For this purpose, the European Commission has long offered a model contract (standard contractual clauses).
The old model contract was outdated
The earlier model contracts were no longer in line with the GDPR and recent case law. Therefore, the European Commission drafted a new model contract: clearer, more flexible, covers more situations, and is GDPR-compliant. Moreover, it takes into account the Schrems II ruling, which declared the EU-US Privacy Shield invalid because the US allegedly failed to adequately protect the data. With the new model contract, you can indeed provide a valid legal basis for transfer to the US — though additional measures remain necessary.
Use, modify, or supplement a model contract
If you use the new model contract without changes or additions, you do not need permission from the Dutch Data Protection Authority (AP). However, if you modify or supplement it, you must first submit it to the AP, which will assess whether the additions conflict with the standard clauses and whether the rights of data subjects are violated. Changes require a more thorough study. Seek legal advice when making adjustments.
Frequently Asked Questions
When do I need a model contract?
If you transfer personal data to a third country without an adequate level of protection and you rely on “appropriate safeguards”, the Commission’s Standard Contractual Clauses form the basis.
Do I need permission from the AP?
Not if you use the model contract unchanged. If you modify or supplement it, you must first submit it to the AP.
Am I still allowed to transfer data to the US?
The new model contract can provide a valid basis for this, but additional measures remain necessary. Also check the current adequacy decisions.
Assistance with international transfer of personal data
The privacy experts at MKB Juristen help you use the right (model) contracts and adapt them if necessary. View our expertise in privacy and data protection or schedule an intake meeting .
