CJEU narrows scope of standard contractual clauses
A preliminary ruling from the Court of Justice of the European Union further narrows the conditions under which SCCs can be relied on for transfers to third countries with surveillance regimes.
Why this matters to you
Clients with cross-border data flows will need updated transfer impact assessments within 90 days under most national regulator guidance.
What changed today
The ruling was published this morning Brussels time.
What we know
- ·Full text of the ruling has been published.
- ·Two national DPAs already issued statements acknowledging the implications.
What we do not know
- ·Exact grace period before active enforcement begins.
Claim breakdown
SCCs are no longer valid for any transfer.
False· Confidence 9%Validity depends on the destination's surveillance regime.
A TIA is now required for most third-country transfers.
Confirmed· Confidence 93%
Source trail
Primary
- Q 99
Judgment in Case C-XXX/24
CJEU · 4h ago
Institutional
- Q 94
DPA statement
CNIL · 2h ago
Framing & bias notes
Industry framing emphasizes operational burden. Privacy NGOs frame it as overdue clarification.
Suggested action
Flag for clients with US/Asia data transfer dependencies. Schedule TIA review.