DataTerminology.comNEW
Also known as: SCCs
EU-approved contractual terms enabling cross-border transfers of personal data with appropriate safeguards.
DESCRIPTION
Standard Contractual Clauses are pre-approved model clauses that organizations can incorporate into contracts to legitimize international personal data transfers under GDPR. Updated in 2021, modular SCCs cover controller-to-controller, controller-to-processor, and other transfer scenarios. Following Schrems II, SCCs require transfer impact assessments and additional safeguards. SCCs impose obligations on exporters and importers regarding transparency, security, and redress. They are widely adopted when no adequacy decision exists. Compliance demands monitoring legal developments and recipient country surveillance laws. SCCs complement technical safeguards like encryption and access controls.
ALTERNATIVE DEFINITIONS
Wikipedia
Standard contractual clauses (SCCs) are standardised and pre-approved model data protection clauses that can be incorporated into contracts to ensure appropriate data protection safeguards for data transfers to countries outside the European Economic Area.
Stresses pre-approved model clauses ensuring safeguards for international transfers.
European Commission
Standard Contractual Clauses are standard sets of contractual terms and conditions which the sender and the receiver of personal data both sign up to, ensuring that data protection requirements are met.
Emphasizes mutual obligations to meet GDPR requirements.
UK Information Commissioner’s Office
Standard contractual clauses are a transfer tool that organisations can use to ensure appropriate safeguards when sending personal data to countries without adequacy decisions.
Frames SCCs as a transfer tool within UK GDPR guidance.
RELATED TERMS
GDPR Adequacy Decision Data Privacy Framework Schrems II International Data Transfer Data Processing Agreement Transfer Impact Assessment EDPB Guidance Controller-Processor Contracts
COMPETING TERMS
Binding Corporate Rules EU-US Data Privacy Framework
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance Data Security
TARGET AUDIENCE
Data Privacy Officer Chief Information Security Officer Data Governance Manager Chief Data Officer IT Manager
EXTERNAL SOURCES
- Wikipedia - Standard contractual clauses
- European Commission - Official SCC overview and materials
- EUR-Lex - Implementing Decision (EU) 2021/914
- European Data Protection Board - Recommendations on transfer safeguards
TOP QUESTIONS
When should Standard Contractual Clauses be used?
Use SCCs for international transfers of personal data to countries lacking adequacy decisions, ensuring GDPR-compliant safeguards between exporter and importer.
Category: HowTo
What changed in the 2021 SCCs?
They introduced modular clauses covering various transfer scenarios, updated obligations post-Schrems II, and improved flexibility for complex processing chains.
Category: Overview
Do SCCs alone guarantee lawful transfers?
No. Organizations must perform transfer impact assessments, implement supplementary measures, and verify recipient laws do not undermine protections.
Category: Misunderstanding
What are common mistakes with SCCs?
Failing to complete annexes, omitting technical measures, and not assessing third-country surveillance laws can invalidate reliance on SCCs.
Category: Mistakes
What risks are associated with SCCs?
Noncompliance risks enforcement actions, fines, and data subject harm if safeguards are inadequate or improperly implemented.
Category: Risks
What are alternatives to SCCs?
Binding Corporate Rules or adequacy decisions like the EU-US Data Privacy Framework can serve as alternative transfer mechanisms.
Category: Alternatives
How are SCCs maintained over time?
Monitor legal developments, review recipient country laws, update annexes and measures, and document assessments and decisions.
Category: Management
Who should be involved in SCC implementations?
Data Privacy Officers, legal counsel, security teams, and business stakeholders to ensure lawful, secure, and practical data transfers.
Category: Requirements
Where can I learn more about SCCs?
Consult European Commission materials, EDPB recommendations, and supervisory authority guidance like the ICO.
Category: Learning