Standard Contractual Clauses (SCC)

The 2021 SCCs abandon the one-size-fits-all approach for a modular system with four distinct transfer scenarios. Parties select and append only the modules relevant to their specific processing roles.

• Module 1: Controller-to-Controller transfers
• Module 2: Controller-to-Processor transfers
• Module 3: Processor-to-Processor transfers
• Module 4: Processor-to-Controller transfers

This structure eliminates legal ambiguity by providing tailored obligations for each relationship, ensuring a processor sub-contracting to another processor has a legally sound mechanism without relying on controller-centric clauses.

The modernized SCCs codify the Schrems II obligation into the contractual text. Parties must warrant that they have no reason to believe the laws of the data importer's country prevent compliance.

• Assessment Scope: Analysis of local surveillance laws and government access powers
• Technical Safeguards: Encryption, anonymization, and split-processing architectures must be documented
• Continuous Monitoring: Ongoing obligation to monitor legal developments in the destination country

This transforms a regulatory guidance note into a binding contractual warranty, creating direct liability for failure to assess third-country legal risks.

A docking clause allows new parties to accede to existing SCCs throughout their lifecycle without re-executing the entire agreement. This is critical for complex data supply chains.

• Accession Process: New parties sign an annex and become full parties with all rights and obligations
• No Amendment Required: Existing parties do not need to renegotiate or re-sign the core clauses
• Time Efficiency: Enables rapid onboarding of sub-processors and new joint controllers

This mechanism acknowledges that modern data processing involves dynamic, multi-party ecosystems rather than static bilateral relationships.

The 2021 SCCs grant direct third-party beneficiary rights to data subjects, allowing individuals to enforce specific clauses directly against both the data importer and exporter.

• Enforceable Clauses: Transparency obligations, purpose limitation, and security requirements
• Liability Provisions: Data subjects can claim material and non-material damages from either party
• Representation Mechanisms: Data subjects may mandate not-for-profit bodies to exercise their rights

This transforms the SCCs from a purely inter-corporate contract into a quasi-regulatory instrument with direct individual enforcement mechanisms.

Responding to concerns about foreign intelligence surveillance, the modernized SCCs impose transparency and challenge obligations when data importers receive government access requests.

• Notification Duty: Importers must notify exporters of legally binding government requests for personal data
• Legality Review: Obligation to assess the lawfulness of the request under both requesting and importer law
• Data Minimization: Requirement to challenge overbroad requests and disclose only the minimum necessary information
• Transparency Reports: Provision of regular aggregated disclosures about government access requests received

Module 2 and Module 3 introduce rigorous sub-processing governance that mirrors GDPR Article 28 requirements within the contractual framework.

• Prior Authorization: General written authorization required, with specific objection rights for material changes
• Flow-Down Obligations: Sub-processors must be bound by substantially equivalent data protection obligations
• Full Liability Chain: The initial importer remains fully liable to the exporter for sub-processor failures
• List Maintenance: Importers must maintain and update a publicly accessible list of authorized sub-processors