Are there any requirements regarding the choice of governing law for the contract?

ANSWER

Clause 17 requires the parties to specify the law governing the application of the SCCs ("governing law"). For Modules 1, 2, and 3, this must be the law of one of the EU Member States or EEA countries. For Module 4, it may also be the law of a country that is not part of the EEA.

For all modules, the governing law must be national law that allows the stipulation of rights in favor of third parties. This means that the chosen law must allow the parties to the contract to stipulate by contract rights that data subjects whose personal data will be transferred under the SCCs can invoke.

For Modules 2 and 3, the SCC text indicates that the governing law will in principle be the law of the EEA country in which the data exporter is established, unless that law does not allow the stipulation of rights in favor of third parties (in which case the parties must choose another law).

Clause 17 should be interpreted in conjunction with Clause 4, which explains that the SCCs must be interpreted in light of the GDPR provisions — in particular where GDPR-defined terms are used. The SCCs should not be interpreted in a manner contrary to the rights and obligations provided for in the GDPR. However, the governing law agreed in Clause 17 will still have significance, for example when calculating time limits.