Regulation and data

Standard contractual clauses

Standard contractual clauses are model contracts approved by the Commission that provide appropriate safeguards for sending personal data outside the EU when the destination country has no adequacy decision. The ones in force are those of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

Published on 19 October 2026

Also known asSCC · SCCs · standard data protection clauses · cláusulas contractuales tipo

How they work

The GDPR only allows data to be transferred to a third country without an adequacy decision if there are appropriate safeguards (art. 46.1), and one of them is the standard clauses adopted by the Commission (art. 46.2.c). They are signed as they stand: the parties pick the module that applies to them, fill in the annexes and may add safeguards as long as these do not contradict the clauses (clause 2).

Module one: controller to controller.
Module two: controller to processor; the case of a centre whose supplier processes the data outside the EU.
Module three: processor to processor; that of a supplier that engages a sub-processor in a third country.
Module four: processor to controller.

Worth knowing

Signing them is not enough. Clause 14 requires the parties to assess whether the law and practices of the destination country —especially access to the data by its public authorities— prevent compliance, and to document that assessment for the supervisory authority. The earlier decisions, from 2001 and 2010, were repealed with effect from 27 September 2021. And they should not be confused with the clauses of Decision 2021/915, which are a model for the art. 28 DPA between controller and processor, not for transfers.

Sources

Related terms