Standard contractual clauses, Module One (controller to controller), Clause 8.1: purpose limitation (Commission Implementing Decision (EU) 2021/914, Annex, Module One, Clause 8.1)
When a buyer receives personal data as its own controller, the clauses bind it to the purposes written in Annex I.B. The licence therefore has to name AI model training as the purpose, and the buyer cannot widen it later.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose: (i) where it has obtained the data subject's prior consent;”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides