{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2021/915 — Decision — Contractual clauses between controllers and processors [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii","url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii","title":"ANNEX II","family":"l2_unit_view","work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","view_of":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Implementing Decision (EU) 2021/915, OJ L 199, 7.6.2021","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng","valid_from":"2021-06-27","valid_until":null,"content_id":"0a7d2c961b31907a","versions":["2021-06-27"],"version_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii/versions/2026-10-26/rev/0a7d2c961b31907a","versions_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii/versions","relations_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii/relations","act_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors#annex-ii","source_line":"Commission Implementing Decision (EU) 2021/915 · binding on its addressees · dated 4 Jun 2021 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_decision","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2021-06-04","entry_into_force":"2021-06-27","locators":{"document_date":"CELLAR 32021D0915 work_date_document","entry_into_force":"CELLAR 32021D0915 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","name":"Commission Implementing Decision (EU) 2021/915","number":"2021/915","celex":"32021D0915","title_official":"COMMISSION IMPLEMENTING DECISION (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (Text with EEA relevance)","document_date":"2021-06-04"},"position":{"kind":"annex","key":"annex-ii","index":3,"articles":4,"annexes":5},"prev":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-i","key":"annex-i","title":"ANNEX I"},"next":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii","key":"annex-iii","title":"ANNEX III"},"act_anchor":"#annex-ii"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors.md","unit_text_sha256":"c7fa34b633b3f669d42466933b62f4753db9326f6d1e23771493d6f35f23a80f","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annex-ii","kind":"annex","key":"annex-ii","heading":"ANNEX II","text":"## ANNEX II\n\n<a id=\"annex-ii\"></a>Description of the processing\n\nCategories of data subjects whose personal data is processed\n\n...\n\nCategories of personal data processed\n\n....\n\nSensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.\n\n...\n\nNature of the processing\n\n....\n\nPurpose(s) for which the personal data is processed on behalf of the controller\n\n...\n\nDuration of the processing\n\n...\n\n...\n\nFor processing by (sub-) processors, also specify subject matter, nature and duration of the processing\n\n","marks":[],"text_hash":"c7fa34b633b3f669d42466933b62f4753db9326f6d1e23771493d6f35f23a80f","revision":1}}