OneTrust Schrems II Response Whitepaper

As a data importer, OneTrust appreciates our customers’ concerns regarding the privacy compliance implications of the Schrems II ruling and the Brexit. We are monitoring developments in the EU concerning cross-border personal data transfers. In response to the European Commission’s 2021 model Standard Contractual Clauses (‘SCCs’) and the guidance from EU Data Protection Authorities and the EDPB, as well as the more recent approval of the Data Privacy Framework (‘DPF’) as a valid adequacy mechanism for transfer between EU-US, UK-US and Swiss-US, we have adopted a number of measures to ensure high level of protection to the personal data transferred outside of the EU/EEA area. We are conscious that the interpretation of data transfer best practices is still evolving. We will continue to track its progress and work to match the best practices available on the market to facilitate protection of the personal data on a high global standard.

With respect to personal data transfers, OneTrust assumes two separate roles respectively to customer data processing. When OneTrust receives personal data from our customers established in the EU, OneTrust acts as a data importer. Accordingly, when OneTrust transfers the personal data outbound, it acts as a data exporter. This clarification further helps to outline the type of transfer and the related obligations of the parties.

For more information, see the OneTrust Schrems II Response Whitepaper.