How Can Compliance with Article 28 GDPR Be Ensured?

ANSWER

The requirements of Article 28 GDPR have been incorporated into Module 2 (controller-to-processor transfers) and Module 3 (processor-to-processor transfers) of the SCCs. Where these modules are used, it is not necessary to conclude a separate data processing agreement, as these modules can ensure compliance both with the requirements of Article 28 GDPR and with the requirements relating to international data transfers under Article 46 GDPR.

A situation may also arise where SCCs for data transfers are not required because another transfer mechanism is available, for example where the data recipient is located in a country that is subject to an adequacy decision. In such cases, the SCCs may still be used to ensure compliance with Article 28 GDPR.