Revised enterprise DPA with new standard contractual clauses

GitHub updates its Data Protection Agreement with revised EU standard contractual clauses

GitHub has released an updated Data Protection Agreement (DPA) and a revised Addendum to Microsoft’s DPA, both incorporating the new standard contractual clauses (SCCs) published by the European Commission on 4 June 2021. The updated documents are available at github.com/enterprise-legal.

The move follows the July 2020 ruling by the Court of Justice of the European Union (CJEU) that invalidated the EU-US Privacy Shield as a mechanism for transferring personal data from the EU to the US, citing concerns about US government access to EU data. In response to that ruling, GitHub had already committed to protecting trans-Atlantic developer collaboration by relying on SCCs, supplemented with additional security measures. Those changes were reflected in updated customer data protection terms and the GitHub Privacy Statement.

The newly published SCCs introduce a modular structure for transfers, stronger protections around EU data transfers, and several other enhancements over the previous framework. GitHub’s revised agreements integrate these clauses as part of an ongoing effort to align with current privacy law and to support developers and customers through formalized data protection commitments.

Beyond the agreements themselves, GitHub points to its Global Privacy Practices and transparency reporting as evidence of continued privacy protections that extend beyond the SCC baseline.