{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2021/914 — Decision — Standard contractual clauses for transfer to third countries [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii","url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii","title":"ANNEX II","family":"l2_unit_view","work_id":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","view_of":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Implementing Decision (EU) 2021/914, OJ L 199, 7.6.2021","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng","valid_from":"2021-06-27","valid_until":null,"content_id":"0c7281c479a8e181","versions":["2021-06-27"],"version_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii/versions/2026-10-26/rev/0c7281c479a8e181","versions_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii/versions","relations_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-ii/relations","act_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries#annex-ii","source_line":"Commission Implementing Decision (EU) 2021/914 · binding on its addressees · dated 4 Jun 2021 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_decision","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2021-06-04","entry_into_force":"2021-06-27","locators":{"document_date":"CELLAR 32021D0914 work_date_document","entry_into_force":"CELLAR 32021D0914 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","path":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","name":"Commission Implementing Decision (EU) 2021/914","number":"2021/914","celex":"32021D0914","title_official":"COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Text with EEA relevance)","document_date":"2021-06-04"},"position":{"kind":"annex","key":"annex-ii","index":3,"articles":4,"annexes":4},"prev":{"path":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-i","key":"annex-i","title":"ANNEX I"},"next":{"path":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annexes/annex-iii","key":"annex-iii","title":"ANNEX III"},"act_anchor":"#annex-ii"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries.md","unit_text_sha256":"223e880d459d1ec51f5163857896cb120ae053cd73fc249fdfcf3e0914b00821","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/annex-ii","kind":"annex","key":"annex-ii","heading":"ANNEX II","text":"## ANNEX II\n\n<a id=\"annex-ii\"></a>TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA\n\nMODULE ONE: Transfer controller to controller\n\nMODULE TWO: Transfer controller to processor\n\nMODULE THREE: Transfer processor to processor\n\nEXPLANATORY NOTE:\n\nThe technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.\n\nDescription of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.\n\n\\[Examples of possible measures:\n\nMeasures of pseudonymisation and encryption of personal data\n\nMeasures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services\n\nMeasures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident\n\nProcesses for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing\n\nMeasures for user identification and authorisation\n\nMeasures for the protection of data during transmission\n\nMeasures for the protection of data during storage\n\nMeasures for ensuring physical security of locations at which personal data are processed\n\nMeasures for ensuring events logging\n\nMeasures for ensuring system configuration, including default configuration\n\nMeasures for internal IT and IT security governance and management\n\nMeasures for certification/assurance of processes and products\n\nMeasures for ensuring data minimisation\n\nMeasures for ensuring data quality\n\nMeasures for ensuring limited data retention\n\nMeasures for ensuring accountability\n\nMeasures for allowing data portability and ensuring erasure\\]\n\nFor transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter\n\n","marks":[],"text_hash":"223e880d459d1ec51f5163857896cb120ae053cd73fc249fdfcf3e0914b00821","revision":1}}