Statement 3/2026 on use of other model clauses

Statement 3/2026 on the use of other models of contractual clauses for onward transfers of personal data Adopted on 10 November 2026 The European Data Protection Board has adopted the following statement: Today, the European Commission has announced a relevant development in relation to the use of the EU Standard Contractual Clauses (“EU SCCs”) by updating the Frequently asked questions (FAQs) on the new Standard Contractual Clauses available on its website. In particular, the European Commission has recognised that, alongside the EU SCCs, the Model Contractual Clauses developed by the Council of Europe on the basis of the Convention 108+ 1 (CoE MCCs) 2 , and the Model Contractual Clauses developed by the Ibero-American Data Protection Network 3 (RIPD MCCs) 4 may be used for onward transfers. This means that, under the conditions explained in the European Commission’s FAQs, these sets of Clauses may ensure that the level of protection of natural persons as guaranteed by the EU data protection law is not undermined when data is onward transferred. As a result, along the possibility to use EU SCCs for onward transfers, entities receiving data under the EU SCCs have also the possibility to rely on Model Contractual Clauses adopted by the Council of Europe on the basis of the Convention 108+ and on Model Contractual Clauses developed by the Ibero-American Data Protection Network. This possibility should ensure a high level of personal data protection while facilitating cross- border data flows. It is a way to build bridges around model contractual clauses from different jurisdictions that present an appropriate level of convergence, and it will help entities operating 1 Convention 108+ is not in force yet as not enough contracting states have ratified it yet. 2 Model Contractual Clauses for the Transfer of Personal Data (Module 1) as adopted on 27 June 2023; Model Contractual Clauses for the Transfer of Personal Data (Module 2) as adopted on 17 November 2023; Model Contractual Clauses for the Transfer of Personal Data (Module 3) as adopted on 7 June 2024. It is for each Party to Convention 108+ to decide whether to approve these clauses as standardised contractual tool for data transfers. 3 The RIPD MCCs are recognised by a limited number of Latin American (LATAM) countries unlikely the EU SCCs that - given their nature - are recognised by all EU SAs as a legally binding instrument under the GDPR . 4 Guide for the Implementation of Model Contractual Clauses and Model Contractual Clauses as published on 27 September 2022. 3 | Adopted (iii) ensure continued compliance with any other applicable safeguards and obligations under the EU SCCs , including Clause 11(e) and Clause 13(b) related to duty of the first importer of the original transfer to cooperate with the competent supervisory authority and courts under the EU SCCs, and the obligation of the first importer of the original transfer to abide by a decision that is binding under the applicable EU or Member State law. This means that in the case of an onward transfer, the first importer should ensure that it remains able to comply with its obligations under the EU SCCs, including in its relationship with the second data importer. (iv) when a further onward transfer is made pursuant to Clause 15 of the CoE MCCs or Clause 6.9 of the RIPD MCCs, follow the recommendations set out in the European Commission’s FAQs. Against this background, the EDPB welcomes and endorses the possibility recognised by the European Commission to use the Model Contractual Clauses developed by the Council of Europe on the basis of the Convention 108+ and the Model Contractual Clauses developed by the Ibero-American Data Protection Network as instruments to onward transfer personal data received under the EU SCCs. Furthermore, the EDPB stands ready to engage with other fora and organisations to promote increased convergence in order to foster future interoperability of various model contractual clauses. For the European Data Protection Board The Chair (Anu Talus)