Common use of TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS Clause in Contracts

TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS. 1. Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in com- pliance with Chapter V GDPR and UK GDPR. 2. In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest. 3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses: a. transfer personal data to a data controller or a data processor in a third country or in an international organization b. transfer the processing of personal data to a sub-processor in a third country c. have the personal data processed in by the data processor in a third country 4. The data controller’s instructions regarding the transfer of personal data to a third country including, if appli- cable, the transfer tool under Chapter V GDPR or UK GDPR on which they are based, shall be set out in Appendix C.6. 5. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR and UK GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR and UK GDPR.

TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS. 1. 8.1 Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in com- pliance compliance with Chapter V GDPR and UK GDPR. 2. 8.2 In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest. 3. 8.3 Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses: a. transfer personal data to a data controller or a data processor in a third country or in an international organization b. transfer the processing of personal data to a sub-processor in a third country c. have the personal data processed in by the data processor in a third country 4. 8.4 The data controller’s instructions regarding the transfer of personal data to a third country including, if appli- cableapplicable, the transfer tool under Chapter V GDPR or UK GDPR on which they are based, shall be set out in Appendix C.6. 5. 8.5 The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c46(2) (c) and (d) GDPR and UK GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR and UK GDPR.

TRANSFER OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS. 1. Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in com- pliance compliance with Chapter V GDPR and UK GDPR. 2. In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, is required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest. 3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of the Clauses: a. transfer personal data to a data controller or a data processor in a third country or in an international organization b. transfer the processing of personal data to a sub-processor in a third country c. have the personal data processed in by the data processor in a third country 4. The data controller’s instructions regarding the transfer of personal data to a third country including, if appli- cableapplicable, the transfer tool under Chapter V GDPR or UK GDPR on which they are based, shall be set out in Appendix C.6. 5. The Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR and UK GDPR, and the Clauses cannot be relied upon by the parties as a transfer tool under Chapter V GDPR and UK GDPR.