SCC

Standard contractual clauses (SCCs) are model contract terms, adopted by the European Commission, that give legal safeguards for sending personal data from the EU or EEA to countries without an adequacy decision.

The GDPR allows transfers outside the EEA in three main ways: to countries the Commission has found adequate, under appropriate safeguards such as SCCs or binding corporate rules, or under narrow exceptions. Once the exporter and the importer sign them, no regulator's approval is needed, which is why SCCs are widely used.

The current clauses were adopted on 4 June 2021 by Commission Implementing Decision (EU) 2021/914 and replaced three older sets made under the 1995 Data Protection Directive (European Commission, accessed 9 November 2026). They are modular, with separate modules for controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers.

Signing is not enough on its own. In Schrems II, on 16 July 2020, the CJEU held that exporters must check case by case whether the law of the destination country undermines the clauses, and add supplementary measures where needed (CJEU, C-311/18). That check is called a transfer impact assessment. Transfers to US companies certified under the Data Privacy Framework do not need SCCs, but many firms keep them as a fallback.

Example: An EU publisher sends bid logs to a US analytics vendor that is not certified under the Data Privacy Framework. The parties sign Module Two, controller to processor. The publisher documents a transfer impact assessment, and the vendor encrypts the logs with keys held in the EU.

Related terms: Data Privacy Framework, data processing agreement, CLOUD Act, data residency, sovereign cloud.

Authoritative source: European Commission, "Standard contractual clauses (SCC)" (Implementing Decision (EU) 2021/914 of 4 June 2021; accessed 9 November 2026).