Glossary
Standard contractual clauses (SCCs)
Model contract clauses adopted by the European Commission, used for international transfers (Art. 46) and controller-processor contracts (Art. 28).
Standard contractual clauses (SCCs) are model contracts adopted by the European Commission. Two sets exist. For international data transfers, Article 46(2)(c) GDPR recognises standard data protection clauses as an appropriate safeguard, and Commission Implementing Decision (EU) 2021/914 of 4 June 2021 provides SCCs with four modules: controller to controller, controller to processor, processor to processor, and processor to controller. Separately, Commission Implementing Decision (EU) 2021/915 provides SCCs that can serve as the Article 28 contract between controllers and processors.
After the CJEU's Schrems II judgment (C-311/18, 16 July 2020), signing transfer SCCs is not enough on its own. The exporter must assess whether the law and practice of the destination country allow the importer to comply, often documented as a transfer impact assessment, and add supplementary measures where needed, as described in EDPB Recommendations 01/2020.
For security and IT teams, SCCs create technical obligations. The annexes describe the security measures, and effective supplementary measures are often technical: strong encryption with keys held under the exporter's control in the EEA, or pseudonymisation before transfer. Remote support access from a third country can itself be a transfer. See our guide to international data transfers.