The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the processor and another processor, nor from adding other clauses or additional safeguards provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by the Commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects. Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses.
* This title is an unofficial description.
Why Recital 109 Matters for GDPR Compliance?
Recital 109 matters for GDPR compliance because it explains the use of standard data protection clauses adopted by the European Commission or supervisory authorities. These clauses provide a practical and reliable legal mechanism for transferring personal data to third countries while maintaining GDPR-level protection. The recital also clarifies that organizations may include additional safeguards, provided they do not conflict with the approved clauses. This ensures flexibility while maintaining consistency and legal certainty in international data transfers.