This article looks at the European Commission’s recent revisions to the controller-processor model clauses to allow the transfer of personal data to processors and sub-processors based outside of the EEA. These new sub-processing provisions are the subject of a recent opinion by the Article 29 Working Party that is both helpful and is likely to ease the use of these clauses. However, many of the other problems associated with the use of these clauses remain, especially the lengthy and bureaucratic filing and approval requirements mandated under many national laws.