Privacy Glossary

Standard Contractual Clauses

Pre-approved contract clauses issued by the European Commission for lawfully transferring personal data outside the EEA.

GDPR

Full Definition

Standard Contractual Clauses (SCCs) are standardised contracts approved by the European Commission that provide a valid transfer mechanism for transferring personal data from the EU/EEA to third countries that have not received an adequacy decision. The 2021 SCCs replaced older versions and introduced four modules: controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller transfers. Following Schrems II, SCCs must be supplemented by a Transfer Impact Assessment (TIA) to assess whether the SCCs can be effective in the destination country. SCCs are the most commonly used transfer mechanism globally.

How each law treats it

GDPRArticle 46(2)(c) + 2021 modular SCCs

The European Commission's 2021 Standard Contractual Clauses are the most commonly used safeguard for transfers outside the EEA. Modular — Module 1 (C→C), Module 2 (C→P), Module 3 (P→P), Module 4 (P→C).

UK GDPRICO International Data Transfer Agreement (IDTA)

The UK's post-Brexit equivalent. The IDTA + the UK Addendum to the EU SCCs are both valid. The old 2010 EU SCCs are no longer accepted for new transfers.

UAE PDPLArticle 23 (approved clauses)

The UAE Data Office is expected to publish approved contractual clauses as part of the Executive Regulations. Until then, GDPR-model clauses are the common interim choice.

In practice

Pick the right module per transfer. C→P is the most common; the modules differ in liability and audit clauses.
Pair every SCC-based transfer with a Transfer Impact Assessment (TIA) documenting the recipient-country surveillance landscape and compensating controls.
Keep the SCC package together — the clauses, the annexes (categories, data subjects, technical measures, sub-processors) and the TIA.

Common pitfalls

Using the pre-2021 SCCs for new contracts. The Commission's transition expired 27 December 2022.
Signing the main body without filling in the annexes. The annexes are the operational heart of the SCCs.
Treating SCCs as sufficient without the TIA. The EDPB requires both post-Schrems II.

Frequently asked questions

Do I need SCCs for an EU-US transfer under the Data Privacy Framework?+

If the US recipient is certified under the DPF, no — the DPF provides adequacy. For non-certified recipients, SCCs plus a TIA remain the standard.

Can I modify the SCCs?+

You can add clauses that don't contradict the SCCs. You cannot amend the SCCs themselves — they are a package deal.

What's a TIA?+

A Transfer Impact Assessment — the post-Schrems II documented analysis of whether the SCCs plus any supplementary measures provide essentially equivalent protection in the destination country.

Back to all terms