{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2021/915 — Decision — Contractual clauses between controllers and processors [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii","url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii","title":"ANNEX III","family":"l2_unit_view","work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","view_of":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Implementing Decision (EU) 2021/915, OJ L 199, 7.6.2021","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng","valid_from":"2021-06-27","valid_until":null,"content_id":"00b66161ed80feee","versions":["2021-06-27"],"version_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii/versions/2026-10-26/rev/00b66161ed80feee","versions_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii/versions","relations_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iii/relations","act_url":"https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors#annex-iii","source_line":"Commission Implementing Decision (EU) 2021/915 · binding on its addressees · dated 4 Jun 2021 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_decision","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2021-06-04","entry_into_force":"2021-06-27","locators":{"document_date":"CELLAR 32021D0915 work_date_document","entry_into_force":"CELLAR 32021D0915 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","name":"Commission Implementing Decision (EU) 2021/915","number":"2021/915","celex":"32021D0915","title_official":"COMMISSION IMPLEMENTING DECISION (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (Text with EEA relevance)","document_date":"2021-06-04"},"position":{"kind":"annex","key":"annex-iii","index":4,"articles":4,"annexes":5},"prev":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-ii","key":"annex-ii","title":"ANNEX II"},"next":{"path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annexes/annex-iv","key":"annex-iv","title":"ANNEX IV"},"act_anchor":"#annex-iii"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors.md","unit_text_sha256":"0048ba7fd746365f304fa2658637aa7989da92443b39557cc63cb1c682926ecc","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/annex-iii","kind":"annex","key":"annex-iii","heading":"ANNEX III","text":"## ANNEX III\n\n<a id=\"annex-iii\"></a>Technical and organisational measures including technical and organisational measures to ensure the security of the data\n\nEXPLANATORY NOTE:\n\nThe technical and organisational measures need to be described concretely and not in a generic manner.\n\nDescription of the technical and organisational security measures implemented by the processor(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, as well as the risks for the rights and freedoms of natural persons. Examples of possible measures:\n\nMeasures of pseudonymisation and encryption of personal data\n\nMeasures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services\n\nMeasures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident\n\nProcesses for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing\n\nMeasures for user identification and authorisation\n\nMeasures for the protection of data during transmission\n\nMeasures for the protection of data during storage\n\nMeasures for ensuring physical security of locations at which personal data are processed\n\nMeasures for ensuring events logging\n\nMeasures for ensuring system configuration, including default configuration\n\nMeasures for internal IT and IT security governance and management\n\nMeasures for certification/assurance of processes and products\n\nMeasures for ensuring data minimisation\n\nMeasures for ensuring data quality\n\nMeasures for ensuring limited data retention\n\nMeasures for ensuring accountability\n\nMeasures for allowing data portability and ensuring erasure\\]\n\nFor transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller\n\nDescription of the specific technical and organisational measures to be taken by the processor to be able to provide assistance to the controller.\n\n","marks":[],"text_hash":"0048ba7fd746365f304fa2658637aa7989da92443b39557cc63cb1c682926ecc","revision":1}}