SCC, short for standard contractual clauses, are model data protection contract terms adopted by the European Commission that an exporter and an importer sign to provide appropriate safeguards for transfers of personal data to a country outside the European Economic Area. Under the GDPR, they are one of the transfer tools listed in Article 46, used whenever the destination country has no adequacy decision.
In privacy practice, SCCs are the most widely used transfer mechanism for cloud services, outsourcing and group data flows. They work by binding the recipient contractually to European protection standards and by giving affected individuals enforceable rights against both parties.
How standard contractual clauses legitimize a transfer
Chapter V of the GDPR allows a transfer to a third country only if the destination ensures adequate protection or if the exporter provides appropriate safeguards. Standard contractual clauses supply those safeguards through a contract whose wording is pre-approved by the Commission, so no individual authorization from a supervisory authority is needed.
The current set was adopted by Commission Implementing Decision (EU) 2021/914. Organizations may not change the core clauses, but they complete the annexes that describe the parties, the transfer and the security measures, and they may add commercial terms that do not contradict the clauses or reduce the protection they provide.
The table below shows the main building blocks of the 2021 clauses and what each requires in practice.
| Component | What it does | Practical consequence |
|---|---|---|
| Third-party beneficiary clause | Lets data subjects enforce the clauses | Individuals can claim against exporter or importer |
| Docking clause | Allows new parties to accede later | One agreement can cover a growing group of entities |
| Local laws clause | Requires an assessment of laws in the destination | Parties document a transfer impact assessment |
| Government access clause | Obliges the importer to notify and challenge requests | Importer reviews and contests disproportionate demands |
| Annex I | Lists parties, data categories and purposes | Must be specific, not a generic template |
| Annex II | Describes technical and organizational measures | Encryption, access control and logging in concrete terms |
The four modules of the SCC
The 2021 clauses use a modular structure. The parties select the module that matches their roles under the GDPR, and a single agreement may combine several modules when roles differ across data flows.
| Module | Exporter role | Importer role | Typical case |
|---|---|---|---|
| Module 1 | Controller | Controller | Sharing customer data with a foreign business partner |
| Module 2 | Controller | Processor | Using a cloud provider hosted outside the EEA |
| Module 3 | Processor | Processor | A processor engaging a foreign sub-processor |
| Module 4 | Processor | Controller | Returning processed data to a non-EEA client |
Modules 2 and 3 already contain the elements of an Article 28 processing agreement, so they can replace a separate data processing agreement for that relationship. The Commission also adopted a distinct set of clauses for controller-processor contracts inside the EEA, which are not a transfer tool.
Transfer impact assessments and supplementary measures
Signing the clauses is not sufficient on its own. In the Schrems II judgment of July 2020, the Court of Justice of the EU confirmed that SCCs remain valid but held that exporters must verify, case by case, whether the law and practice of the destination country allow the importer to comply with them.
This verification is documented in a transfer impact assessment. It examines public authority access to data, available legal remedies and the importer’s experience with such requests. Where the assessment reveals gaps, the exporter must adopt supplementary measures, such as strong encryption with keys held only in the EEA, pseudonymization before export, or contractual commitments to transparency.
If no combination of measures provides essentially equivalent protection, the transfer must be suspended or not started at all. Supervisory authorities have ordered exactly that in several enforcement cases, so the assessment is a substantive obligation, not a formality.
SCC compared with other transfer tools
Standard contractual clauses compete with several other mechanisms. The right choice depends on the destination, the group structure and the transfer volume.
| Mechanism | Basis | Best suited for | Main drawback |
|---|---|---|---|
| Adequacy decision | Commission finding on a country | Any transfer to that country | Exists only for selected countries |
| EU-U.S. Data Privacy Framework | Adequacy for certified U.S. companies | Recipients that self-certify | Depends on the importer’s certification |
| SCC | Commission-approved contract | Most third-party and intragroup flows | Requires a transfer impact assessment |
| Binding corporate rules | Approved internal group policy | Large multinational groups | Lengthy approval by authorities |
| Article 49 derogations | Specific situations such as explicit consent | Occasional, non-repetitive transfers | Interpreted narrowly |
Outside the EU, the UK GDPR uses its own instruments: the International Data Transfer Agreement or an addendum to the EU clauses. Organizations transferring from both regions commonly sign the EU clauses together with the UK addendum.
Common mistakes when using SCCs
Most problems arise not from the clauses themselves but from incomplete implementation. Typical failures include the following.
- Completing the annexes with vague, generic descriptions that do not identify the real data categories and purposes.
- Selecting the wrong module because the controller and processor roles were not analyzed.
- Skipping the transfer impact assessment or copying one written for a different country.
- Ignoring onward transfers to sub-processors, which must receive equivalent protection.
- Modifying the clause text, which removes the pre-approved status and may require authority approval.
In everyday language
Standard contractual clauses are a ready-made contract approved by the EU. A European company signs it with a partner abroad before sending personal data there. The partner promises to protect the data the way European law expects.
The contract also lets the people whose data is sent complain and claim compensation. Still, the European company must check whether the foreign country’s laws make those promises impossible to keep. A signature alone is not enough.
Seen in the real world
A mid-sized online retailer based in Germany moves its customer support ticketing to a provider that stores data in a data center outside the EEA, in a country without an adequacy decision. The retailer acts as controller and the provider as processor, so the parties sign Module 2 of the standard contractual clauses, with Annex I listing customer names, order histories and support messages.
The retailer’s privacy team carries out a transfer impact assessment and finds that local authorities can request data without effective judicial review. As a supplementary measure, the provider enables encryption with customer-managed keys stored in the EU, and the retailer documents the residual risk. Twelve months later, a supervisory authority audit reviews the file and accepts the transfer, because the assessment, annexes and measures are consistent with each other.