{
  "url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-10/division-a",
  "json_url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-10/division-a.json",
  "legislation": "eudn/2016/1250",
  "legislation_title": "Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance) (revoked)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2016-1250",
  "path": "annex/II/division/III/division/10/division/a",
  "kind": "division",
  "number": "a",
  "heading": "Data Processing Contracts",
  "text": "i..When personal data is transferred from the EU to the United States only for processing purposes, a contract will be required, regardless of participation by the processor in the Privacy Shield.\nii..Data controllers in the European Union are always required to enter into a contract when a transfer for mere processing is made, whether the processing operation is carried out inside or outside the EU, and whether or not the processor participates in the Privacy Shield. The purpose of the contract is to make sure that the processor:\n1..acts only on instructions from the controller;\n2..provides appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alternation, unauthorized disclosure or access, and understands whether onward transfer is allowed; and\n3..taking into account the nature of the processing, assists the controller in responding to individuals exercising their rights under the Principles.\niii..Because adequate protection is provided by Privacy Shield participants, contracts with Privacy Shield participants for mere processing do not require prior authorization (or such authorization will be granted automatically by the EU Member States), as would be required for contracts with recipients not participating in the Privacy Shield or otherwise not providing adequate protection.",
  "extent": "E+W+S+N.I.",
  "status": "repealed",
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Decision revoked (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), Sch. 3 para. 1(o); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2016/1250/annex/II/division/III/division/10/division/a",
    "retrieved_at": "2026-11-01T15:13:53.293736+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}