Standard contractual clauses are the standard for all data processing providers and document the obligation for the supplier to comply with EU data protection legislation. 4. The data exporter keeps a list of sub-processing agreements concluded under the clauses and communicated by the data importer in accordance with point 5, point j), and updated at least once a year. The list is subject to the data protection regulator of the data exporter. The EU`s standard contractual clauses aim to facilitate the transfer of personal data from the European Economic Area (EEA) to other countries, while providing adequate safeguards for the protection of personal data. These clauses are part of our addendum Data Processing and offer another opportunity to meet the adequacy requirements and are therefore an alternative to the US Privacy Shield Framework or binding Corporate Rules. The group found that the implementation of the provisions of Microsoft`s agreements was in line with its strict requirements. (Microsoft was the first cloud service provider to receive a confirmation letter and approval from the group.) The authorization included the obligations contained in the 2010/87/EU model clauses, but not in the annexes, which describe data transfers and security measures implemented by the data importer. The annexes can be analysed separately by the DATA authority.

EU data protection legislation regulates the transfer of personal data from EU customers to countries outside the European Economic Area (EEA), which include all EU countries, as well as Iceland, Liechtenstein and Norway. Eu standard EU clauses are standardised contractual clauses that are used in agreements between service providers (such as Microsoft) and their customers, to ensure that personal data leaving the EEA is transferred in accordance with EU data protection legislation and complies with the requirements of Directive 95/46/EC on data protection. Mandatory requirements of national legislation applicable to the importer of data that do not exceed what is necessary in a democratic society on the basis of one of the interests listed in Article 13, paragraph 1 of Directive 95/46/EC, where they are a necessary measure to protect national security, defence, public safety, prevention, research, research and prosecution of criminal offences or ethical violations of regulated professions. , a significant economic or financial interest of the state or the protection of the person concerned or the rights and freedoms of others are not in contradiction with the standard contractual clauses. These binding requirements, which do not exceed what is necessary in a democratic society, include internationally recognized sanctions, tax reporting obligations or reporting obligations to combat money laundering.