New Model Contractual Clauses (SCCs) for International Data Transfers

Personal Data Protection Law 25326 (PDPL) generally prohibits international transfers of personal data to countries or international organizations lacking adequate levels of data protection. However, the PDPL allows such transfers when data subjects consent to it or when contractual clauses or self-regulation systems ensure adequate data protection levels.

In this context, the former data protection authority approved through Resolution 60-E/2016 the model contractual clauses for the international transfer of personal data outside of Argentina. Further, the Data Protection Authority (DPA), through Resolution 159/2018, established guidelines for binding corporate rules.

Recently, through Resolution 198/2023, the DPA approved the model contractual clauses from the Ibero-American Data Protection Network (RIPD), following the “Implementation Guideline on Model Contract Clauses for International Personal Data Transfers.” These clauses—divided into two sets: controller to controller and controller to processor—align with advanced standards such as the EU General Data Protection Regulation, the Convention 108+, and the EU and New Zealand’s Standard Contractual Clauses.

The guideline emphasizes that the RIPD’s model contractual clauses aim to ensure compliance with the data protection laws of the exporting country when there is a transfer of data to a third country that lacks adequate protection. It also recommends using them for all international transfers—even those in which the data subject consented to the transfer—to comply with data protection principles.

It is important to note that when incorporating the RIPD’s model clauses into the Argentinian regulatory framework, the IAPP did not repeal the model clauses approved through Resolution 60-E/2016, which remain in force and applicable.

You can access the English text of the RIPD’s model contractual clauses here.