Standard contractual clauses (SCCs)
Also known as: SCCs, model clauses, EU model contract clauses, standard data protection clauses
Standard contractual clauses (SCCs) are model contract terms, approved by the European Commission, that companies sign to legally transfer personal data from the EU to countries without an adequacy decision.
While they're the workhorse of international data transfers, signing them is no longer enough on its own. Since the Schrems II ruling, companies must also assess whether the destination country's laws let them actually honour the clauses.
Standard contractual clauses (SCCs), explained at three levels
At home
Think of SCCs as a standard lease the EU wrote in advance. When a European company sends your data to a supplier in a country without an EU adequacy decision, both sides sign this pre-approved contract, promising to protect your data to EU standards. They fill in the details, like what data is sent and how it's secured, but they cannot rewrite the core terms.
At work
Standard contractual clauses are model contract terms adopted by the European Commission under GDPR Article 46. A data exporter in the EU and an importer abroad sign them to make a transfer lawful when the destination has no adequacy decision. Businesses care because SCCs are the most common transfer tool for vendors and subsidiaries outside adequate countries, and they come with assessment duties.
At home
SCCs work by giving you rights under a contract you didn't sign. Through a 'third-party beneficiary' clause, you can enforce certain promises against the exporter or importer, such as getting a copy of the clauses, access to your data, and compensation for damage. The importer must also tell the exporter if local laws or a government demand stop it from keeping its promises, and the transfer may then have to stop.
At work
The 2021 SCCs are modular. Companies pick the module matching their relationship: controller to controller, controller to processor, processor to processor, or processor to controller. They fill in annexes describing the parties, the data, and the security measures, and cannot change the core clauses. Alongside them, the exporter documents a transfer impact assessment showing the destination's laws let the importer comply. For UK transfers, companies use the UK addendum or the International Data Transfer Agreement.
At home
The hard question is government access. If a destination country's laws let authorities demand data without safeguards comparable to EU law, the contract can't stop them, because a private agreement can't override a state's laws. Supplementary measures try to fill the gap through encryption, pseudonymization, or splitting data. While contractual and organizational measures help, in my view encryption where the recipient never holds the keys is often the only measure that truly addresses that risk.
At work
A transfer impact assessment examines the destination's surveillance laws, the practical likelihood of access requests, and technical safeguards such as encryption and pseudonymization. Adequacy removes that step: EU-to-Canada transfers to organizations under PIPEDA don't need SCCs, though onward transfers from Canada to other countries can. Other regimes run their own standard contracts, including Brazil's ANPD clauses and China's CAC standard contract, so multinationals often manage several versions for a single data flow.
Real-world examples
At home
Nadia, an EU resident, used an online service that outsourced customer support to a company in the Philippines. The privacy notice explained that her data was protected by standard contractual clauses, which gave her enforceable rights if the support company misused it.
At work
Thomas manages vendor contracts at a Montreal software company that receives EU customer data and uses a subprocessor in India. Because Canada has EU adequacy, the first transfer was covered, but Thomas added SCCs for the onward transfer to India and documented a transfer impact assessment.
Common confusions
- Signing SCCs is all you need to do. — Since Schrems II, companies must assess the destination country's laws and add supplementary measures if needed.
- You can edit SCCs to fit your business. — The core clauses can't be changed. You can add commercial terms that don't contradict them, and you fill in the annexes.
- SCCs are needed for transfers to Canada. — Canada has an EU adequacy decision for commercial organizations under PIPEDA, so SCCs generally aren't needed for those transfers.
For analysts
Keep a transfer register that lists every international flow, the mechanism used, and when the assessment was last reviewed. I'd make it part of vendor onboarding, because most transfer problems come from new suppliers nobody assessed.
History & origin
The European Commission first approved standard contractual clauses in 2001, with updated sets in 2004 and 2010. For years, signing them was largely a formality. That changed in July 2020, when the Schrems II ruling upheld SCCs in principle but required companies to verify, case by case, that the destination country offered essentially equivalent protection, adding 'supplementary measures' where needed. In June 2021, the Commission adopted modernized SCCs with a modular structure covering different relationships, such as controller-to-processor. The UK created its own International Data Transfer Agreement and an addendum to the EU clauses in 2022. In my opinion, SCCs are a reasonable tool that became a paperwork industry once Schrems II added transfer impact assessments.