Schrems II / EU Standard Contractual Clauses (SCCs)

Why does it matter?

Transfers out of the EEA to countries without an adequacy decision run on these clauses: they are the Article 46 safeguard for most exports to the United States, India, China and everywhere else, and the supervisory authorities, the EDPB's Recommendations 01/2020 and the Commission's Questions and Answers read them as a package with a documented assessment of the destination's laws. The transition ended on 27 December 2022, so a contract still on the 2010 clauses no longer provides appropriate safeguards. For transfers to the United States the EU-US Data Privacy Framework adequacy decision of 10 July 2023 is the alternative for certified importers, but the SCCs remain the tool for every other importer and for US importers that are not certified.

Key benefits include:

• One text, four modules

The clause and annex structure lets one template serve controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers, with the Article 28(3) and (4) processor terms built in (Article 1(2)).

• Supervisory authority recognition

Clause 13 names the competent supervisory authority, and Clause 14(d) requires the parties to document their assessment and make it available to that authority on request, so the paperwork is examinable.

• Enforceable by data subjects

Clause 3 gives data subjects third-party beneficiary rights, Clause 11 a redress route and Clause 12 compensation, which is why the Decision treats the clauses as appropriate safeguards with enforceable rights and effective remedies.

• A documented assessment

Clause 14 turns Schrems II into a contractual warranty: the parties warrant they have no reason to believe the destination's laws and practices prevent compliance, document why, and the importer notifies the exporter if that changes (Clause 14(e)).

• Multi-party by design

The optional docking clause (Clause 7) lets an entity that is not a party accede, with the agreement of the parties, by completing the Appendix and signing Annex I.A, so group and supply-chain arrangements do not need a new contract per party.

How does it work?

Articles 1 to 4 of the Decision are short. Article 1 declares the annexed clauses appropriate safeguards under Article 46(1) and (2)(c) GDPR and, for controller-to-processor and processor-to-sub-processor transfers, a text that satisfies Article 28(3) and (4); Article 2 obliges a Member State whose authority suspends or bans transfers under Article 58 GDPR to inform the Commission; Article 3 schedules an evaluation as part of the Article 97 GDPR review; Article 4 sets the entry into force, the repeal of the old decisions from 27 September 2021 and the grace period to 27 December 2022 for unchanged processing operations.

The Annex opens with general clauses: purpose and scope (Clause 1), effect and invariability (Clause 2: the text may not be modified except to select modules and options and to add or update the Appendix), third-party beneficiaries (Clause 3), interpretation (Clause 4), hierarchy over conflicting agreements (Clause 5), description of the transfer (Clause 6) and the optional docking clause (Clause 7). Clause 8 holds the module-specific data protection safeguards, from purpose limitation and transparency to security, onward transfers and processing on documented instructions. Clause 9 governs sub-processors with Option 1 (specific prior authorization) or Option 2 (general written authorization with an agreed list in Annex III), Clause 10 data subject rights, Clause 11 redress, Clause 12 liability and Clause 13 supervision.

Section III addresses third-country law. Under Clause 14 the parties warrant that they have no reason to believe the destination's laws and practices prevent the importer from fulfilling the clauses, having taken account of the circumstances of the transfer, the relevant laws and any contractual, technical or organizational safeguards (Clause 14(b)), and they document that assessment for the supervisory authority (Clause 14(d)). Clause 15 obliges the importer to notify the exporter of legally binding public authority requests and of direct access, to review their legality and to challenge them where there are reasonable grounds. Clause 16 covers suspension and termination when compliance is no longer possible, Clause 17 the governing law of a Member State that allows third-party beneficiary rights, and Clause 18 the courts of a Member State.

Key Elements

• Four modules (Annex)

Module One controller to controller, Module Two controller to processor, Module Three processor to processor, Module Four processor to controller; the parties keep the module that fits the transfer and delete the others.

• Docking clause (Clause 7, optional)

An entity that is not a party may accede at any time, as exporter or importer, with the agreement of the parties, by completing the Appendix and signing Annex I.A.

• Sub-processors (Clause 9, Modules Two and Three)

Option 1 specific prior written authorization or Option 2 general written authorization from an agreed list with advance notice of changes; the list sits in Annex III.

• Local laws and practices (Clause 14)

The transfer impact assessment as a warranty: documented, available to the supervisory authority, with the importer's duty to notify changes and the exporter's duty to suspend if safeguards cannot be ensured.

• Access by public authorities (Clause 15)

Notification of binding requests and of direct access, aggregate information where notification is prohibited, legality review and challenge, and disclosure of the minimum permissible.

• Annexes I to III

Annex I lists the parties, the description of the transfer and the competent supervisory authority; Annex II the technical and organizational measures including security; Annex III the authorized sub-processors.

What does it cover?

The Decision covers transfers by a controller or processor whose processing is subject to the GDPR (the data exporter) to a controller or sub-processor whose processing is not subject to the GDPR (the data importer), to any third country without an adequacy decision or alongside one where the parties prefer a contract (Article 1(1)). It is not designed for importers whose processing falls under Article 3(2) GDPR, which the Commission's page lists as a separate set still in development. The clauses bind the signatories and give data subjects enforceable rights; they do not bind the destination country's authorities, which is why Clauses 14 and 15 and the EDPB's supplementary measures exist.

What are its objectives?

The Decision's Article 1 and the recitals set out what the clauses are for.

Provide appropriate safeguards under Article 46(1) and (2)(c) GDPR for transfers to importers outside the GDPR.

Give data subjects enforceable rights and effective legal remedies against the exporter and the importer.

Make the parties assess and document whether third-country law lets the importer comply, as the Schrems II judgment requires.

Serve controller and processor transfer chains with one modular text that also satisfies Article 28(3) and (4).

Replace the 2001 and 2010 clauses that predated the GDPR, with a transition that ended on 27 December 2022.

Framework in Context

The SCCs are one of the Article 46 transfer tools next to binding corporate rules, approved codes of conduct and certification mechanisms, and they sit below adequacy decisions such as the EU-US Data Privacy Framework decision of 10 July 2023. The EDPB's Recommendations 01/2020 on measures that supplement transfer tools (final version adopted 18 June 2021) give the method for the Clause 14 assessment and the supplementary measures that may be needed, and the Commission's Questions and Answers for the two sets of SCCs (25 May 2022) explain the modules, the docking clause and the transition. The controller-processor clauses adopted the same day under Article 28(7) are a separate instrument for processing without a transfer.

Common Framework Mappings

Organizations map the SCC obligations to the privacy and security frameworks they already run so that the Annex II measures and the Clause 14 assessment reuse existing evidence.

Mapped frameworks include:

APEC CBPR System

Binding Corporate Rules (BCRs)

GDPR

EU-US DPF

ISO 27018

ISO 27701

NIST Privacy Framework v1.0

UK GDPR