Standard Contractual Clauses (SCCs) are pre-approved contractual templates issued by the European Commission that enable the lawful transfer of personal data from the European Economic Area to third countries lacking an adequacy decision, by binding data exporters and importers to GDPR-equivalent data protection obligations. The 2021 SCCs replaced older versions and introduced a modular structure covering controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers.
Content
- The original EC SCCs date from 2001 and were updated in 2004 and 2010. The Court of Justice of the European Union’s Schrems II ruling (July 2020) invalidated Privacy Shield and confirmed SCCs remain valid but require case-by-case TIAs. The Commission responded with revised, modular SCCs adopted in June 2021 with an 18-month transition period expiring December 2022.
- Technically, the 2021 SCCs are structured around four modules: Module 1 (controller-to-controller), Module 2 (controller-to-processor), Module 3 (processor-to-processor), and Module 4 (processor-to-controller). Each module contains mandatory clauses on purpose limitation, data subject rights, onward transfers, security obligations, and supervisory authority cooperation. Parties select applicable modules and complete annexes specifying processing details, security measures, and sub-processor lists.
- In practice, large cloud providers (AWS, Microsoft Azure, Google Cloud) offer pre-executed SCC addenda to their data processing agreements, reducing customer overhead. However, organisations must still conduct TIAs considering the legal regime of the third country — particularly US intelligence access under FISA Section 702 and Executive Order 12333 — and document supplementary measures such as encryption, pseudonymisation, or contractual restrictions on government access requests.
- From 2024, the EU-US Data Privacy Framework (adequacy decision, July 2023) reduces SCC reliance for US transfers where the importer is certified under the Framework. However, legal challenges (Schrems III) are anticipated, making SCC maintenance a prudent parallel track. UK organisations continue to use IDTAs and the UK Addendum to EU SCCs for dual-compliance where both GDPR and UK GDPR apply.