EDPB Document setting forth a Cooperation Procedure for the Authorisation of Contractual Clauses under Article 46(3)(a) GDPR and for the Adoption of Standard Contractual Clauses under Article 46(2)(d) GDPR

15 January 2026 2 | Adopted 3 | Adopted The European Data Protection Board Having regard to Article 4 6 , Article 70( 1)(t ) and Article 70(1)(u) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Dir ective 95/46/EC, (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to Article 3 and Article 22 of its Rules of Procedure, has adopted the following D ocument Introduction

According to Article 46(1) of Regulation (EU) 2016/679 (hereinafter “ GDPR ”), any transfer to controllers and/or processors in third countries not covered by a European Commission adequacy decision could be carried out if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subj ect rights and effective legal remedies for data subjects are available.

Article 46(2)(d) GDPR envisages that these appropriate safeguards may be provided, without requiring any specific authorisation from a supervisory authority (hereinafter “ SA ”), by “ standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2) ” (hereinafter “ SA SCCs ”).

Article 46(3)(a) GDPR envisages that, subject to the authorisation from the competent SA, the appropriate safeguards in question may also be provided for by “ contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation ” (hereinafter “ Ad hoc contractual clauses ” or “ Ad hoc CCs ”). In such a case, the authorisation is intended to confirm that the Ad hoc contractual clauses provide for appropriate s afeguards, under article 46 GDPR, with regard to the transfer of personal data to a third country or an international organization taking place in specific situations where standard contractual clauses could be less (or not) suitable to frame the transfers at stake (e.g. due to sector - specific provisions/safeguards to be envisaged or specificities linked to the nature of the controllers and/or processors involved in the transfers). The authorization envisaged by Article 46(3)(a) GDPR does not entail therefore any authorization of specific processing activity, including transfers of per sonal data, carried out on the basis of the Ad hoc CCs.

In both the abovementioned cases, pursuant to Article 64(1)(d) and (e) GDPR, a competent SA which “ aims to determine standard data protection clauses referred to in point (d) of Article 46(2) ” or “ aims to authorise contractual clauses referred to in point (a) of Article 46(3) ”, shall communicate its draft decision to the European Data Protection Board (hereinafter “ EDPB ” or “ the Board ”) in order to request its opinion. 1 References to “Member States” made throughout this document should be understood as references to “EEA Member States”. 4 | Adopted

As a result, SA SCCs may be adopted and Ad hoc contractual clauses can be authorised by the competent SA 2 in the relevant jurisdiction only in accordance with the consistency mechanism set out in Article 63 GDPR 3 , under which the EDPB will issue a non - binding opinion on the draft decision submitted by the competent SA 4 . 1 Scope

The GDPR does not lay down specific rules for the cooperation which should take place among SAs before the formal procedure is triggered under Article 64 GDPR. In accordance with Article 70(1)(u) GDPR 5 , this document sets forth an informal procedure for identifying, when necessary, the Competent SA that will act as the Lead Authority for the SA SCCs or Ad hoc CCs referred to in Articles 46(2)(d) and 46(3)(a) GDPR, and facilitating its cooperation with the other SAs prior to submitting its draft decision to the EDPB. To this effect, the aim of this procedure is to create the best forum to have the discussions on SA SCCs and Ad hoc CCs, also by envisaging the organiza tion of Ad hoc CCs and SCC sessions, in order to ensure consistency and ease the work of the Board. This considering that both SA SCCs and Ad hoc contractual clauses may be used by controllers/processors in more than one Member State.

This document will be reviewed, and if necessary updated, based on the practical experience gained through its application. 2 Cooperation Procedure for the Authorisation of Ad hoc Contractual Clauses under Article 46(3)(a) GDPR with only One Competent Authority

While most contracts to legally frame international transfers that are currently being used by organisations are entirely based on the standard contractual clauses adopted by the European Commission 6 , there could be cases where the transfer contracts would be specifically designed in order to regulate a specific transfer or set of transfers . In these cases, the GDPR envisages th at an authorisation of A d hoc contractual clauses according to Article 46(3)(a) 2 Article 57 ( 1 ) GDPR states that “ W ithout prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory : […] (j) adopt standard contractual clauses referred to [ ... ] in point (d) of Article 46(2) ; […] (r) authorise contractual clauses and provisions referred to in Article 46(3) ” . See also Article 58 ( 3 ) GDPR according to which “ Each supervisory authority shall have [all of] the [following] authorisation and advisory powers: […] (g) to adopt standard data protection clauses refe rred to [...] in point (d) of Article 46(2); (h) to authorise contractual clauses referred to in point (a) of Article 46(3) ”. 3 See also Article 46 (4) GDPR according to which “ The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article ”. 4 See Article 64(1) GDPR. 5 Article 70 ( 1)(u) GDPR states that “ The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular: […] (u) promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities ”. 6 Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, see https://eur - lex.europa.eu/eli/dec_impl/2021/914/oj 5 | Adopted GDPR should be required from the Competent SA , i.e. the SA competent for the Member State where the applicant is established .

With consistency being the ultimate objective to be achieved in cases under Article 64(1)(e) GDPR, a cooperation procedure before the formal procedure is triggered under Article 64 GDPR may also be helpful in cases of A d hoc contractual clauses drafted by a controller or processor aimed to cover transfers from one Member State only. This also having in mind that A d hoc contractual clauses authorized by a SA in one Member State may be used as a model for the same kind of transfers falling under the jurisdiction of other SAs in their respective Member States (e.g. in case the applicant intends to join a multi - party contract in the field of scientific research in relation to which the Ad hoc CCs have been authorised). 2.1 Identification of the Ad hoc CCs Lead and Ad hoc CCs Lead review phase

Where the Ad hoc CCs are intended to provide appropriate safeguards for transfers taking place only from one Member State, the applicant will request the authorisation only in the relevant Member State , by also providing i nformation on the specificities of the transfers 7 . The competent SA receiving the application for the authorisation in accordance with Article 46(3)(a) GDPR will act as the lead SA for the Ad hoc CCs ( hereinafter “ Ad hoc CCs Lead ” ) . The Ad hoc CCs Lead will start the discussions with the applicant and review the draft Ad hoc CCs in order to assess their compliance with the requirements of the GDPR .

The Ad hoc CCs Lead will circulate the consolidated draft among all SAs, via the EDPB Secretariat, in accordance with Article 57(1)(g) GDPR. According to this procedure, any SA may send comments, where relevant, in order to ensure consistency e.g. with A d hoc CCs previously adopted 9 . The period for comments on the consolidated draft will not exceed one month 10 . 7 E.g. information should be provided on the specific context in which they will have to be used, the importers to be involved, the reasons why e.g. standard contractual clauses of the European Commission could be less or not suitable to frame the transfers at stake . 8 The final draft and the authorised Ad hoc CCs should be translated by the applicant , as a general rule, into the language of the competent SA . 9 The EDPB Secretariat may participate at this stage w ith the aim to advance any possible comment that may arise at a later stage, once the formal procedure under article 64 GDPR is triggered. The early involvement of the EDPB Secretariat would facilitate the assessment and contribute to achieve a smoother formal phase . 10 Under justifiable circumstances, the one - month deadline may be extended . 6 | Adopted 2.3 Ad hoc CCs session

An “Ad hoc CC s Session” could be organi s ed by the Ad hoc CCs Lead , if necessary 11 , to present the draft a d hoc CC s to all participants i.e., staff members of SAs and the EDPB Secretariat in order to discuss and/or consolidate the comments received. In light of the cooperation duty set forth in Article 57(1)(g) GDPR all SAs shall partake in the Ad hoc CCs Sessions (see Annex I) .

Pursuant to Article 46(4) and Article 64(1)(e) GDPR, the Ad hoc CCs Lead will submit to the EDPB its draft decision on the “final draft” of the Ad hoc CCs along with all information, and views of the other SAs in cases where an agreement has not been reached.

The EDPB will adopt an opinion on the matter in accordance with Article 64(3) GDPR and with its Rules of Procedure. 2.5 Authorization by the Ad hoc CCs Lead

Where the opinion of the EDPB endorses the submitted draft decision, the Ad hoc CCs Lead will authorise the A d hoc CCs in accordance with Article 46(3)(a) GDPR, and inform the EDPB of such adoption in accordance with Article 64(7) GDPR. If the same Ad hoc CCs 12 will be used subsequently in a different Member State and therefore an authorization is needed by another SA , the n EDPB may decide, on a case - by - case basis , that the Article 46(3)(a) GDPR draft decision of this other SA concerns the same matter as the initial EDPB opinion (e.g. that they refer to the same kind of transfers). In such cases, the Board may find that there is no need to adopt a new opinion in accordance with Article 64(3) GDPR. To this end, the requesting SA should provide the Board with its decision on the final draft Ad hoc CCs accompanied with all relevant i nformation to support the view that no new opinion under article 64(2) GDPR is needed. 3 Cooperation Procedure for the Authorisation of Ad hoc Contractual 11 The “Ad - hoc CCs sessions” should address controversial or remaining issues that were not solved in order to reach consensus on the expectations for Ad - Hoc CCs and communicate these to the applicant. 12 It is the understanding of the EDPB that these Ad hoc CCs will have to be used at the same conditions e.g. transfers carried out in the same context, concerning the same categories of personal data and data subjects, and same purposes of the processing. 7 | Adopted Clauses under Article 4 6 (3)(a) GDPR with more than One Competent Authority

There could be cases where the same sets of contractual clauses may need to be used to provide appropriate safeguards at the same conditions for the same kind of transfers 13 taking place from different Member States, for instance in the context of a multi - party contract in the field of scientific research where transfers take place from the EEA to third country. In this case, different Competent SAs should be approached for the authorisation under Article 46(3)(a) GDPR and would therefore be tasked with analysin g them in order to assess their compliance with the requirements of the GDPR. In those situations, consistency also should be ensured. 3.1 Identification of the Lead SA

The applicant interested in submitting draft Ad hoc contractual clauses for the authorisation by the competent SA according to Article 46(3)(a), Article 63 and Article 64 GDPR, should identify a SA as the lead SA, among all the competent SAs, for the Ad ho c CCs.

The role of the Ad hoc CCs Lead includes acting as single point of contact with the organisation(s) (hereinafter “applicant”) during the authorization procedure and managing the application procedure in its cooperation phase.

Particular attention will be given to the factor described under para 24(a) above. 13 E .g. transfers carried out in the same context, concerning the same categories of personal data and data subjects, and same purposes of the processing. 14 See Article 46 ( 3 )( a ) GDPR. 15 These criteria reflect those already envisaged in the BCRs application form s ( EDPB R ecommendations 01/2022 o n the A pplication for A pproval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR), and WP265 Recommendation on the Standard Application for Approval of Processor Binding Corporate Rules for the Transfer of Personal Data (endorsed by the EDPB ) ; and in the WP226 , adopted by the Article 29 Working Party , Working Document Setting Forth a Co - Operation Procedure for Issuing Common Opinions on”Contractual clauses” Considered as compliant with the EC Model Clauses) . 8 | Adopted

The applicant should provide the prospective Ad hoc CCs Lead SA with all appropriate information in writing which justifies its proposal for the identification of the lead 16 . 3.2 Ad hoc CCs Lead review phase

The prospective Ad hoc CC s Lead SA will forward the information received as to why the applicant has identified it as the L ead SA for the A d hoc CCs to all SAs with an indication of whether or not it agrees to be Ad hoc CCs Lead within a period of two weeks . If the proposed SA agrees to be the Ad hoc CC s Lead, the other SAs will be asked, under Article 57 ( 1 )( g ) GDPR, to raise any objections within two weeks 17 . Silence will be deemed as agreement .

The Ad hoc CCs Lead will then start discussions with the applicant and review the draft a d hoc CC s in pursuance of a draft that contains the appropriate safeguards as required by Article 46 GDPR . 3.3 Co - review phase

In order to foster a more consistent approach, the Ad hoc CC s Lead will send, in accordance with Article 57 ( 1 )( g ) GDPR, a first revised draft of the a d hoc CC s and the related documents 18 , if any , to one or two SAs , depending on the number of Member States from whose territories the transfers will take place 19 , which will act as “ co - reviewers ”, in order to help the Ad hoc CC s Lead in the assessment of the draft ad hoc CCs . In case a SA acting as co - reviewer does not respond within one month 20 , from the date the draft ad hoc CCs and the related documents 16 To facilitate further distribution among SAs, the applicant shall provide the documentation related to the relevant criteria for identifying the Lead SA (see para 24 in the text) in writing i.e. digitally and on paper. Information should also be provided on the peculiarites of the transfers , e.g. the specific context in which they will have to be used, the importers involved, the reasons why e.g. standard contractual clauses could be less suitable to frame the transfers at stake . 17 This two - week period may be extend ed by two additional weeks if requested by any SA. 18 The draft Ad hoc CCs and relevant information should be provided, as a general rule, in the language of the Ad hoc CCs Lead and in English , if possible , in accordance with national law . The final draft and the authorised Ad hoc CCs should be translated by the applicant into the languages of the SAs concerned . 19 As a rule, the Ad hoc CC Lead will consult 2 co - reviewers whenever 14 Member States or more are concerned by transfers. Under this threshold it is possible to have one or two co - reviewers depending on the specific case and the availability of SAs. 20 Under justifiable circumstances, the one - month deadline may be extended. 9 | Adopted have been sent to it , then that SA will be deemed to have agreed with them. There may need to be several different drafts or exchanges , i.e. rounds 21 , between the applicant and the co - reviewers before a satisfactory draft is produced. 3.4 Cooperation phase

Once the comments of the co - reviewers have been addressed , a “consolidated draft” should be sent by the applicant to the Ad hoc CCs Lead, which will circulate it among all SAs , via the EDPB Secretariat, in accordance with Article 57(1)(g) GDPR, for comments 22 . According to this procedure, the period for comments on the consolidated draft will not exceed one month 23 . A SA which has not sent comments within this period shall be deemed to be in an agreement . 3.5 Ad hoc CCs session

An “Ad hoc CCs Session” may be organised by the Ad hoc CCs Lead, where necessary 24 , to present the draft to all participants i.e. staff members of SAs and the EDPB Secretariat , in order to discuss and /or consolidate the comments received . In light of the cooperation duty set forth in Article 57(1)(g) GDPR all SAs shall partake in the Ad hoc CCs Sessions (see Annex I) .

Pursuant to Article 46 ( 4 ) and Article 64 ( 1 )( e ) GDPR, the Ad hoc CC s Lead will submit to the EDPB its draft decision on the “ final draft ” of the A d hoc CC s accompanied with all information, documentation and the views of other SAs in cases where an agreement has not been reached. The EDPB will adopt an opinion in accordance with Article 64 ( 3 ) GDPR and its Rules of Procedure. 3.7 Authorization procedure by the Ad hoc CCs Lead

Where the opinion of the EDPB endorses the Ad hoc CC s Lead ’s draft decision, the Ad hoc CC s Lead will authori s e the Ad hoc CC s in accordance with Article 46 ( 3 )( a ) GDPR, and inform the EDPB of such adoption in accordance with Article 64(7) GDPR . 21 A round starts when the Ad hoc CCs Lead sends out the draft Ad hoc CCs with its comments or the comments of the co - reviewers/ other SAs (depending on the phase of the procedure), and ends when the Ad hoc CCs Lead or co - reviewers/other SAs review whether t heir comments have been addressed appropriately. If the Ad hoc CCs Lead or co - reviewers/ other SAs are not satisfied then another round is triggered. 22 The aim of the EDPB Secretariat’s participation at this informal stage is to advance any possible comment that may arise at a later stage once the formal procedure under article 64 GDPR has been triggered. The early involvement of the EDPB Secretariat would facilitate the assessment and contribute to achieve a smoother formal phase . 23 Under justifiable circumstances, the one - month deadline may be extended. 24 The general aim is to speak with one voice to the applicant. To this end, the “Ad - hoc CCs sessions” should address controversial or remaining issues that were not solved during the previous phase of the informal cooperation, in order to reach consensus on the standards and expectations for Ad - Hoc CCs and communicate these in one voice to the applicant 10 | Adopted

If the same Ad hoc CCs will be used subsequently in a different Member State and therefore an authorization is needed by another SA 25 , t he EDPB may decide , on a case - by - case basis, that the Article 46(3)(a) GDPR draft decision of this other SA submitted to it, concerns the same matter as the initial EDPB opinion ( e.g. that they refer to the same kind of transfers) . In such cases, the Board may find that there is no need to adopt a new opinion in accordance with Article 64 (3) GDPR . To this end, the requesting SA provides the Board with its decision on the final draft Ad hoc CCs accompanied with all relevant information to support the view that no new opinion under article 64(2) GDPR is need ed. 4 C ooperation P rocedure for the A pproval of S tandard C ontractual C lauses under A rt icle 46 ( 2 )( d ) GDPR

According to Article 46 ( 2 )( d ) GDPR , appropriate safeguards may be provided for by standard contractual clauses adopted by a SA and approved by the European Commission pursuant to the examination procedure referred to in Article 93 ( 2 ) GDPR . In the case foreseen by Article 46 ( 2 )( d ) GDPR , the resulting SCC s would be added to the ones directly adopted by the European Commission pursuant to Article 46 ( 2 )( c ) GDPR 26 .

O nce approved by the European Commission , pursuant to the examination procedure referred to in Article 93 ( 2 ) GDPR, the SA SCC s under Article 46 ( 2 )( d ) GDPR may be used by controllers or processors in more than one Member Sta te 27 . In order to ensure consistency and ease the work of the Board, cooperation among all EEA SAs, as described in this document, prior to the referral to the EDPB for an Opinion, is recommended.

To this effect the cooperation procedure envisaged in Section 3 of this document may be applied whenever a SA intends to adopt SCCs in accordance with Article 46(2)(d) GDPR, and present them for an opinion of the EDPB 28 . 4.1 SA SCCs Lead review and cooperation phase

In such cases, the SA intending to adopt SA SCC s will act as the L ead SA for the cooperation procedure (hereinafter “ SA SCCs Lead ” ) , and it will work on a first draft and send it for comments to other SAs , via the EDPB Secretariat 29 , in accordance with Article 57 ( 1 )( g ) GDPR. According to this procedure, the period for comments on the first draft will not exceed one month 30 . 25 E .g. transfers carried out in the same context, concerning the same categories of personal data and data subjects, and same purposes of the processing. 26 Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council . 27 SA SCCs adopted by a SA, may, after their approval by the European Commission, be used for transfers from other Member States tha n that of the SA SCCs Lead SA’s, without the need for the competent SAs of those other Member States to adopt the same SA SCCs . 28 See a rticle 64 ( 1 )( d ) GDPR. 29 The EDPB Secretariat may also participate at this stage with the aim to advance any possible comment that may arise at a later stage, once the formal procedure under article 64 GDPR is triggered. The early involvement of the EDPB Secretariat would facilitate the assessment and contribute to achieve a smoother formal phase . 30 Under justifiable circumstances, the one - month deadline may be extended. 11 | Adopted 4.2 SA SCCs session 42 “SA SCCs Sessions” is meant to present the draft and, where necessary, address controversial or remaining issues that were not solved during the informal cooperation, in order to reach an agreement on the expectations for SA SCCs 31 . In light of the cooperation duty set forth in Article 57(1)(g) GDPR all SAs shall partake in the SA SCCs Sessions.

A “SA SCC s Session” should, in any case, be organi s ed by the SA SCCs Lead to present the draft SA SCC s to all participants i.e., staff members of SAs and the EDPB Secretariat. The European Commission is invited to participate, taking into account its role under Article 46(2)(d) GDPR) , in order to discuss and consolidate the comments received. 4.3 EDPB Opinion

When the SA SCC s Lead is of the view that all comments received by SAs have been addressed, it will inform the other SAs and, pursuant to Article 46 ( 4 ) and Article 64 ( 1 ) GDPR, it will submit to the EDPB its draft decision on the “ final draft ” of the SA SCC s, a ccompanied with all relevant information and the views of the SAs in cases where an agreement with the SA SCC s Lead has not been reached. The EDPB will adopt an opinion in accordance with Article 64 ( 3 ) GDPR and its Rules of Procedure. 4.4 Adoption procedure by SA SCCs Lead

Where the opinion handed down by the EDPB endorses the SA SCCs Lead’s submitted draft decision on the draft SA SCC s , the SA SCC s Lead will adopt the SA SCC s in accordance with Article 46 ( 2 )( d ) GDPR and will inform the EDPB of its adoption in accordance with Article 64(7) GDPR .

In addition, t he SA SCCs Lead will inform the European Commission of its adoption of the SA SCC s in light of the approval procedure by the European Commission pursuant to Article 93(2) GDPR.

Until th e European Commission approves the SA SCCs , the SA SCC s could be used by controllers or processors as a model for appropriate safeguards to be introduced in Ad Hoc CCs for transfers of personal data under Article 46(3)(a) GDPR. Their use however would be subject to an authorisation by the competent SA of the Member State from which the transfers to a thir d country are envisaged.

Once the European Commission approves the SA SCCs, they may be used as appropriate safeguards for transfers under Article 46(2)(d) GDPR from all the Members States without the need to obtain additional authorisation. For the European Data Protection Board The Chair Anu Talus 31 A SA which has not shared comments during this session or during the previous phase shall be deemed to be in agreement with the draft. 12 | Adopted Annex I - Procedure for informal “Ad hoc CCs and SA SCCs session” The objective of this annex is to provide information on the Ad hoc CCs and SA SCCs session procedure as described in sections 2.3, 3.5 and 4.2 above . 13 | Adopted 1 I ntroduction a. The aim of the informal procedure below is to develop the procedural aspects related to the organisation of CCs Sessions before the formal procedure is triggered under Article 64 GDPR in relation to the authorization of Ad hoc CCs under Article 46(3)(a) GD PR and the adoption of SA SCCs under Article 46(2)(d) GDPR.

In accordance with Article 70(1)(u) GDPR, the Board shall promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between supervisory authorities (hereinafter “SAs”). To this effect, the present proce dure aims at facilitating such cooperation between SAs 32 by envisaging the organization of Ad hoc CCs or SA SCCs Sessions as a best forum to discuss and present the draft in order to reach a “final draft” of the CCs which will then be submitted to the EDPB for an Opinion. 2 A d H oc CCs sessions

Organizing a session is not mandatory but highly recommended in order to expedite the formal procedure for an Opinion of the Board (hereinafter “Opinion”) . In particular, it is a best practice to put the Ad hoc CCs up for discussion at a session, where necessary, in order to facilitate the smooth adoption of the Opinion by the Board pursuant to Article 64 GDPR .

The session will be coordinated by the Lead(s) in order to streamline the discussion(s) to facilitate reaching a common understanding 34 . In particular, t he Lead shall: 32 In light of the cooperation duty set forth in Article 57(1)(g) GDPR all SAs shall partake in the SA SCCs session or Ad hoc CC s session. 33 In light of the cooperation duty set forth in Article 57(1)(g) GDPR, all SAs shall partake in the sessions. 34 The Lead shall aim to reach a consensus i.e. common understanding among SAs on the safeguards which need to be provided by virtue of the contractual clauses. 14 | Adopted 1 Share , prior to the session, the updated version of the Ad hoc CCs that address es the comments received , if any ; and 2 The list of identified discussion points, and, if relevant, include the comments of SAs relating to the discussion points for which a session is organised; 3 Present during the session the Ad hoc CCs(s), the identified discussion points and the latest comments of SAs on these points.

Taking into account that, according to Article 46(2)(d) GDPR, the SA SCCs should be approved by the Commission pursuant to the examination procedure referred to in Article 93(2) GDPR, the Board considers that there is a need to facilitate and streamline th e cooperation between the Board and the European Commission in this respect. 35 The scope of the discussion in the ITS ESG shall only pertain to the particular aspect for which objections have been raised. The Lead shall request time on the ITS ESG agenda to present the particular aspect and provide possible solutions. SAs shall disc uss in order to reach a suitable solution. If there is no ITS ESG planned within a reasonable time, the Lead will contact the ITS ESG coordinators and EDPB Secretariat to discuss the appropriate next steps in order to be able to address the objection( s) raised by the relevant SA(s). If no solution is found, the issue shall, if necessary, and in accordanc e with paragraph 13 , be brought before the plenary. 36 The Lead will discuss with the EDPB Secretariat whether the EDPB Secretariat or the Lead, solely or together with the EDPB Secretariat, will present the discussion points during the plenary. This may differ on a case by case basis. 37 It is advised that the outcome from the session include specific wording forwarded by the Ad hoc CCs Lead to the applicant without a redraft. T he Lead shall mention to the applicant that the outcome is the result of the discussions with all SAs and shall, if necessary, discuss with the applicant, the possible consequences if the provided input is not implemented by the applicant into the Ad hoc C Cs. 15 | Adopted

To this end, at least one SA SCCs session shall be organised in order inform the Commission on the draft SA SCCs and the safeguards the clauses provide in relation to the transfer or set of transfers for which it may be used . In particular, the SA SCCs session shall allow for the presentation of the draft SA S CCs and address any discussion points in order to work out a common understanding, prior to the article 64 procedure is triggered. In short, the aim of the session is to d i scuss and find consensus on the appropriate safeguards to be included in the SA S CCs.

I f no objections have been made within the aforementioned period, the Lead shall amend the SA SCCs without undue delay in order to prepare the draft SA SCCs to be presented for the Opinion of the Board pursuant to Article 64 GDPR .

At the ITS ESG meeting, the ITS ESG members will discuss the unsolved issue ( s ) and will decide upon a suitable solution. When an agreement involves elements that have a substantial impact on the assessment of the SA S CCs, then the ITS ESG may decide, after discussion at the ESG level, to bring the matter for guidance to the Plenary. Additionally, from the discussions during the session it might be necessary to find agreements regarding substantial 38 See the cooperation duty set forth in Article 57(1)(g) GDPR. 39 The scope of the discussion in the ITS ESG shall only pertain to the particular aspect for which objections have been raised. The Lead shall request time on the ITS ESG agenda to present the particular aspect and provide possible solutions. SAs shall disc uss in order to reach a suitable solution. If there is no ITS ESG planned within a reasonable time, the Lead will contact the ITS ESG coordinators and EDPB Secretariat to discuss the appropriate next steps in order to be able to address the objection( s) raised by the relevant SA(s). If no solution is found, the issue shall, if necessary, and in accordanc e with paragraph 24, be brought before the plenary. 16 | Adopted elements of SA S CCs. In those cases, the specific questions may be brought for discussion at the ITS ESG and, if necessary, to the Plenary for a decision 40 .