Standard contractual clauses (SCCs)
Also known as: SCCs, model clauses, EU model contract clauses, standard data protection clauses
Standard contractual clauses (SCCs) are model contract terms, approved by the European Commission, that companies sign to legally transfer personal data from the EU to countries without an adequacy decision.
While they're the workhorse of international data transfers, signing them is no longer enough on its own. Since the Schrems II ruling, companies must also assess whether the destination country's laws let them actually honour the clauses.
Standard contractual clauses (SCCs), explained at three levels
At home
When a European company sends your data to a supplier in another country, it often signs a special contract promising to protect your data the same way it would be protected in Europe. Those contracts are standard contractual clauses.
At work
If your business sends personal data from the EU to a country without an adequacy decision, such as many countries in Asia or South America, you'll usually need SCCs in your contract with the recipient. Your lawyer or vendor often provides them.
At home
SCCs give you rights too. You can enforce some of the clauses as a 'third-party beneficiary,' meaning you can take action if the companies break their promises about your data, even though you didn't sign the contract.
At work
The 2021 SCCs have four modules: controller to controller, controller to processor, processor to processor, and processor to controller. Companies pick the module matching their relationship, fill in annexes describing the data and security measures, and cannot change the core text. A transfer impact assessment should be documented alongside them.
At home
The hard question is government access. If a destination country's laws let authorities demand data without safeguards comparable to EU law, the clauses alone may not protect you. In my view, encryption where the recipient never holds the keys is often the only supplementary measure that truly addresses that risk.
At work
Transfer impact assessments evaluate the destination country's surveillance laws, the likelihood of access requests, and technical measures such as encryption and pseudonymization. Canada's adequacy status means EU-to-Canada commercial transfers covered by PIPEDA don't need SCCs, but onward transfers from Canada to other countries can. Other regimes, including Brazil and China, have adopted their own standard contracts, so multinationals manage several versions.
Real-world examples
At home
Nadia, an EU resident, used an online service that outsourced customer support to a company in the Philippines. The privacy notice explained that her data was protected by standard contractual clauses, which gave her enforceable rights if the support company misused it.
At work
Thomas manages vendor contracts at a Montreal software company that receives EU customer data and uses a subprocessor in India. Because Canada has EU adequacy, the first transfer was covered, but Thomas added SCCs for the onward transfer to India and documented a transfer impact assessment.
Common confusions
- Signing SCCs is all you need to do. — Since Schrems II, companies must assess the destination country's laws and add supplementary measures if needed.
- You can edit SCCs to fit your business. — The core clauses can't be changed. You can add commercial terms that don't contradict them, and you fill in the annexes.
- SCCs are needed for transfers to Canada. — Canada has an EU adequacy decision for commercial organizations under PIPEDA, so SCCs generally aren't needed for those transfers.
For analysts
Keep a transfer register that lists every international flow, the mechanism used, and when the assessment was last reviewed. I'd make it part of vendor onboarding, because most transfer problems come from new suppliers nobody assessed.
History & origin
The European Commission first approved standard contractual clauses in 2001, with updated sets in 2004 and 2010. For years, signing them was largely a formality. That changed in July 2020, when the Schrems II ruling upheld SCCs in principle but required companies to verify, case by case, that the destination country offered essentially equivalent protection, adding 'supplementary measures' where needed. In June 2021, the Commission adopted modernized SCCs with a modular structure covering different relationships, such as controller-to-processor. The UK created its own International Data Transfer Agreement and an addendum to the EU clauses in 2022. In my opinion, SCCs are a reasonable tool that became a paperwork industry once Schrems II added transfer impact assessments.