Standard Contractual Clauses (SCC)

Standard Contractual Clauses are pre-approved contract templates that provide a lawful basis for transferring personal data out of the EEA. The 2021 modular SCCs replaced the 2010 versions; UK and Swiss equivalents exist.

SCC modules

The European Commission's 2021 SCCs (Implementing Decision 2021/914) are modular: Module 1 (controller to controller), Module 2 (controller to processor), Module 3 (processor to processor), Module 4 (processor to controller). The exporter and importer pick the module that matches their roles. The SCCs include mandatory clauses, annexes specifying the transfer details, technical and organizational measures, and sub-processor lists. Use of the SCCs is a "transfer tool" under GDPR Article 46(2)(c) and provides a lawful basis for the data flow.

SCCs after Schrems II

The Schrems II decision (CJEU C-311/18, July 2020) struck down the EU-US Privacy Shield and made clear that SCCs alone are insufficient when the importer's local law allows access by public authorities in ways inconsistent with EU fundamental rights. The exporter must perform a Transfer Impact Assessment (TIA) and implement supplementary measures (encryption with importer-inaccessible keys, pseudonymization, contractual additions) where the destination country fails the test. The EU-US Data Privacy Framework (replacing Privacy Shield, in force July 2023) restores an adequacy mechanism for certified U.S. importers but does not eliminate the TIA obligation for non-DPF transfers.

UK and Swiss variants

The UK uses either the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. Switzerland uses the EU SCCs supplemented by the Swiss Federal Data Protection and Information Commissioner's adaptations. AI vendors with EEA, UK, and Swiss customers typically execute one combined transfer instrument covering all three. New jurisdictions are increasingly publishing their own SCC analogs (Brazil ANPD, South Africa, China for outbound transfers); vendors operating globally need to maintain a SCC matrix.