Standard contractual clauses

What it means

Standard contractual clauses, or SCCs, are model contract terms adopted by the European Commission. They serve as an appropriate safeguard for international data transfers to countries without an adequacy decision. By signing them, a recipient outside the EU undertakes to protect the data under rules comparable to the GDPR.

The current version of the clauses is modular, with modules for different situations: controller to controller, controller to processor, processor to processor and processor back to controller. The parties choose the module matching their roles and complete the annexes describing the transfer and the security measures.

The text of the clauses must not be changed. The parties may add other terms, but these must not contradict the clauses or lower the level of protection. The clauses can be incorporated into another contract, such as a data processing agreement, or signed as a separate document.

How it works in practice

Before relying on the clauses, a transfer impact assessment must be carried out. It evaluates whether the law and practice of the recipient's country, especially public authority access to data, would allow the commitments in the clauses to be circumvented. If so, supplementary measures such as encryption, pseudonymisation or data minimisation must be added, or the transfer abandoned.

With large cloud providers, the clauses are usually part of their contract terms and the company accepts them with the service. With smaller suppliers outside the EU they have to be prepared and signed individually. The clauses belong in the data protection documentation, and the Data Protection Authority may request them in an inspection.

Working with the clauses also means monitoring the recipient's sub-processors. If a processor outside the EU uses further processors, it must bind them to the same rules, and changes in the chain must be notified to the controller. For extensive or high-risk processing a DPIA may also be needed.

What to watch out for

The most common mistake is signing the clauses without a transfer assessment and without completing the annexes. A formally signed document with no real content does not protect the company in an inspection. The annexes must describe exactly what data are transferred, for what purpose, to whom and with what measures.

Older versions of the clauses are no longer valid, and contracts based on them had to be replaced. A company that has not reviewed its contracts with suppliers outside the EU for some time should check which version of the clauses they rely on and update them if necessary.