Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The DPA states that Modal will not transfer EEA or UK Personal Data outside those regions without Customer consent or a compliant transfer mechanism, and that Customer consents in advance to transfers where Modal has implemented GDPR or UK GDPR-compliant safeguards including SCCs, adequacy decisions, or Article 46 safeguards.
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal basis for cross-border personal data transfers by Modal, incorporating EU SCCs (Modules 1-3), UK IDTA, and Swiss law provisions by reference into the DPA. The advance consent mechanism for GDPR-compliant transfers means Customers do not need to separately authorize each transfer where Modal has implemented the specified safeguards.
Under this clause, Personal Data from the EEA, UK, and Switzerland may be transferred outside those regions by Modal only where a GDPR-compliant mechanism is in place, and Customer provides advance consent to such transfers where Modal has implemented compliant safeguards. The SCCs are incorporated by execution of the main agreement rather than by separate signature.
Cross-platform context
See how other platforms handle Cross-Border Data Transfer Mechanisms and similar clauses.
Compare across platforms →Monitoring
Modal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Modal may not transfer Personal Data to, or process such data in, a location outside of the European Economic Area or the UK without Customer's prior written consent, except in compliance with Section 10.2 below. Without prejudice to the foregoing, Customer consents to Transfers where Modal has implemented a Transfer solution compliant with GDPR and UK GDPR, which for example may include: (a) an adequacy decision by applicable authorities; (b) the Standard Contractual Clauses as incorporated herein pursuant to Appendix 1; (c) another appropriate safeguard pursuant to Article 46 of GDPR or UK GDPR equivalent; or (d) a derogation pursuant to Article 49 of GDPR or UK GDPR equivalent.Excerpt from Modal's Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (transfers to third countries), UK GDPR Chapter V, and equivalent Swiss DPA provisions. The SCCs incorporated are based on the European Commission's Implementing Decision 2021/914. The UK IDTA issued by the ICO under s119A of the Data Protection Act 2018 governs UK transfers. Enforcement authorities include EU member state supervisory authorities, the UK ICO, and the Swiss FDPIC. The Schrems II decision (Case C-311/18) and subsequent EDPB guidance on transfer impact assessments are relevant to the adequacy of transfer mechanisms for transfers to the US. (2) GOVERNANCE EXPOSURE: Medium. The advance consent mechanism for compliant transfers is operationally convenient but means Customer accepts whatever transfer mechanism Modal has implemented without per-transfer review. Customers with heightened transfer risk profiles should assess whether they wish to conduct transfer impact assessments for specific Modal subprocessors located in non-adequacy countries. (3) JURISDICTION FLAGS: EU Customers in Germany, France, and other jurisdictions with active supervisory authority enforcement of transfer requirements should ensure that Modal's SCC implementation and any associated transfer impact assessments are documented and available for inspection. UK Customers should confirm that the IDTA implementation is complete and that the required Table 1-3 information is accessible. Swiss Customers should confirm that Swiss-law conforming SCC provisions apply to their transfers. (4) CONTRACT AND VENDOR IMPLICATIONS: Legal teams should confirm that the SCC module selection (Modules 1, 2, and 3) correctly reflects the actual processing relationships between Modal and its subprocessors in each transfer scenario. The DPA specifies Sweden as the governing law for EU SCCs and England and Wales for UK IDTA, which should be reflected in internal transfer documentation. (5) COMPLIANCE CONSIDERATIONS: Data protection officers should document their reliance on the advance SCC consent mechanism and confirm that the DPA's incorporated SCCs are sufficient for their organization's transfer risk profile. Organizations that have conducted transfer impact assessments for US-based cloud providers should assess whether those assessments apply to Modal's subprocessor infrastructure.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the legal basis for cross-border personal data transfers by Modal, incorporating EU SCCs (Modules 1-3), UK IDTA, and Swiss law provisions by reference into the DPA. The advance consent mechanism for GDPR-compliant transfers means Customers do not need to separately authorize each transfer where Modal has implemented the specified safeguards.
Under this clause, Personal Data from the EEA, UK, and Switzerland may be transferred outside those regions by Modal only where a GDPR-compliant mechanism is in place, and Customer provides advance consent to such transfers where Modal has implemented compliant safeguards. The SCCs are incorporated by execution of the main agreement rather than by separate signature.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.