Practise vocabulary for Standard Contractual Clauses, adequacy decisions, Binding Corporate Rules, and GDPR Chapter V.
0 / 5 completed
1 / 5
An EU adequacy decision means:
Adequacy decisions (GDPR Article 45) currently cover countries including UK, Japan, Canada, Switzerland, New Zealand, and the USA (under the EU-US Data Privacy Framework as of 2023). Data can flow to these countries as freely as within the EU.
2 / 5
Standard Contractual Clauses (SCCs) are used when:
SCCs (GDPR Article 46) are the most commonly used transfer mechanism: Module 1 (controller-to-controller), Module 2 (controller-to-processor), Module 3 (processor-to-processor), Module 4 (processor-to-controller). They cannot be modified — they must be used as-is to maintain their pre-approved status.
3 / 5
Binding Corporate Rules (BCRs) are primarily used by:
BCRs are internal codes of conduct for multinational groups. They require supervisory authority approval (lengthy process) but then permit unlimited intra-group transfers globally. More secure than SCCs for complex multinational structures but significant overhead to implement.
4 / 5
A Transfer Impact Assessment (TIA) is required when:
The Schrems II ruling (CJEU 2020) invalidated Privacy Shield and made TIAs mandatory. Exporters must assess: does destination country law (especially government access powers) undermine the protection SCCs provide? If yes, supplementary measures are needed.
5 / 5
The phrase 'data may be transferred to the USA under the EU-US Data Privacy Framework adequacy decision' means:
The EU-US DPF (adopted July 2023) is a self-certification mechanism for US companies. Unlike UK or Swiss adequacy (general), US adequacy only applies to DPF-certified organisations. Non-certified US recipients still require SCCs or other Article 46 safeguards.