Onward data transfers: other model clauses are an option, with safeguards intact

What happened?

On 13 November 2026, the European Data Protection Board (EDPB) announced Statement 3/2026, adopted on 10 November. Following updated European Commission explanations, Council of Europe (CoE) and Ibero-American Data Protection Network (RIPD) model clauses can support certain onward transfers of personal data received under EU Standard Contractual Clauses (SCCs). This is official interpretative guidance.

What does this mean for your business?

An overseas partner of an Estonian business may have an additional contractual option for its next transfer. The roles of the parties and available modules matter. RIPD clauses have no processor-to-processor module.

The first importer remains bound by its SCC obligations, including cooperation with competent supervisory authorities and courts. Completed annexes, purpose limitation and safeguards for sensitive data must continue through the chain.

Who is affected?

Businesses operating in Estonia whose customer or employee data passes through a service provider outside the European Economic Area to another recipient, particularly international groups and services with multiple subcontractors.

What should you do?

Magilex recommends mapping recipients, countries and actual roles, and requesting the contractual basis and completed annexes for the next transfer.

Check module suitability and how your partner continues to meet its SCC obligations. Further onward transfers must also follow the conditions described in the Commission explanations. Having model clauses alone does not establish compliance throughout the chain.

Key dates

The statement was adopted on 10 November 2026; the news announcement was published on 13 November 2026. Neither date marks entry into force of a new law or a general deadline to replace contracts.