SCCs (standard contractual clauses)
Contract clauses approved by the European Commission that let personal data leave the EEA for a country without an adequacy decision.
The current set comes from Commission Decision 2021/914 and has modules for controller and processor combinations. Since the Schrems II judgment of July 2020, the exporter also needs a transfer impact assessment of the destination country’s laws. For US companies certified under the Data Privacy Framework SCCs are not needed, but many contracts keep them as a fallback. The 2021 clauses cannot be used when the importer is itself subject to GDPR; clauses for that case were still pending in 2026.
Related terms
- EU-US Data Privacy Framework (DPF): The legal basis that lets EU personal data go to US companies that certify under it, without extra transfer contracts.
- Data processing agreement (DPA): The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.
- Data residency (AI and cloud): Where your data is stored and processed, including where an AI model runs on it, and whether it can leave a region such as the EU.
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
