In Which Situations Should Module 4 Be Used (Transfer of Data from a Processor to a Controller)?

ANSWER

Module 4 should be used where a processor established in the EEA acts on behalf of a controller established outside the EEA, either by collecting data in the EEA on behalf of that controller or by processing in the EEA data received from that controller. In such cases, the SCCs may be used by the processor to transfer the data (or transfer it back) to the controller.

Example:

A Moroccan company uses cloud services provided by a Luxembourg company. These services consist of storing customer data belonging to the Moroccan company. SCCs (Module 4) may be used to transfer the data from Luxembourg (by the data exporter) (back) to Morocco (to the data importer).

Example:

A Chilean company engages a Spanish service provider to conduct market research and develop marketing materials using customer data received from the Chilean headquarters as well as customer data collected in Spain. Module 4 SCCs may be used by the Spanish service provider to transfer aggregated data relating to these two groups of customers to Chile.