Data and privacy · Privacy counsel, DPO, procurement lead
Assess an international transfer under the standard clauses
A European insurer is moving first-line customer support to a provider outside the EEA and the provider has sent signed standard clauses. The assessment checks the module, the annexes and whether the clauses alone are enough in the destination.
- First draft
- A first transfer assessment comes back from one run, before the support contract is signed.
The problem
Step 01 of 05
Add the contract set
The signed clauses, the services agreement, the provider's security documentation and the data flow description go on one matter with the EU recorded as the jurisdiction.
Project Halcyon: SPA warranties and disclosure
Buy-side warranty review, disclosure analysis and cited due-diligence grid.
- Client
- Halcyon Bidco Ltd
- Reference
- WC-2026-0412
- Practice area
- Corporate / M&A
- Jurisdiction
- England and Wales
- Responsible partner
- E. Vance
No conflict check on file.Chat, on this matter
Compare warranties with the disclosure letter.
Three high-priority exceptions require action: the unregistered charge, the change-of-control right and the tribunal claim.
Send a message… (@ to mention tools)BalancedPrepare for- 25 Aug
Disclosure exceptions matrix
Chat
- 21 Aug
Disclosure exceptions matrix
Run · completed · 560 credits
- 18 Aug
Project Halcyon: Disclosure Letter
Document · indexed
- 16 Aug
Project Halcyon: Share Purchase Agreement
Document · indexed
- 4 Aug
Matter opened
Opened
Step 02 of 05
Check the module and the annexes
Prepare for: Work-Stream Memo. The module is tested against the actual relationship, and each annex is read for whether it describes the processing or merely gestures at it.
Agent
Jurisdiction
Prepare for
Deliver as
Instruction
What should the agent look for?Documents
Drop a contract, or pick one from the matter
Also on the matter
- Offer_letter_v3.pdf2 pages
- Staff_handbook_2025.docx61 pages
- Board_minute_14_Aug.pdf3 pages
Platform model · zero data retention · audit register onStep 03 of 05
Read the annex findings
The technical and organisational measures annex is a list of certifications rather than measures, which does not meet what the clauses require of it.
6 items need your confirmation14 authorities · Where we lookedSenior Associate Employment Contract: English Law Review
Summary
- 1.
Clause 9(c), non-competeHigh
The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.
Tillman v Egon Zehnder Ltd [2019] UKSC 32 - 2.
Clause 11, data and monitoringHigh
Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.
UK GDPR, Arts 6 and 9 - 3.
Clause 4, holiday carry-overHigh
The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.
Working Time Regulations 1998, regs 13 to 13A
- 1.
Step 04 of 05
Assess the destination
The Cross-Jurisdictional Comparator addresses the destination's access laws and the onward transfer position, keeping the assessment separate from the contractual analysis.
6 items need your confirmation14 authorities · Where we lookedSenior Associate Employment Contract: English Law Review
Summary
- 1.
Clause 9(c), non-competeHigh
The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.
Tillman v Egon Zehnder Ltd [2019] UKSC 32 - 2.
Clause 11, data and monitoringHigh
Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.
UK GDPR, Arts 6 and 9 - 3.
Clause 4, holiday carry-overHigh
The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.
Working Time Regulations 1998, regs 13 to 13A
- 1.
Step 05 of 05
Take the conditions
Action items cover the annex rewrite, the supplementary measures required and the review date to set for the assessment.
Replace the UK/Ireland/EU non-compete with a 3 to 6 month restriction tied to competing corporate-law work.
Replace blanket data consent with a lawful-basis clause and a separate monitoring notice.
Remove the five-day carry-over cap and reference the statutory carry-over rules.
Narrow the client non-solicit to clients dealt with in the final 12 months.
Add an explicit working-time opt-out withdrawal mechanism.
Confirm the bonus clause states the discretion is exercised in good faith.
What comes back
A document, not a transcript.
- A module check against the real relationship, with the consequence if the wrong module has been signed.
- An annex-by-annex review naming what each one has to contain and what it currently contains.
- A destination assessment covering access laws and onward transfers, kept separate from the contract review.
- Supplementary measures and a review date, so the assessment does not become a document that ages silently.
Authorities it checks
- Regulation (EU) 2016/679, arts 44 to 49
- Commission Implementing Decision (EU) 2021/914
What it does not do
- It does not test the provider's security controls or audit the destination site.
- It does not sign the clauses or complete the annexes on the client's behalf.
- It does not conclude that a transfer is lawful where the destination assessment depends on facts the client has not supplied.