Standard contractual clauses (SCCs)
Definition
Standard contractual clauses are model data protection terms adopted by an authority that, signed unchanged, provide appropriate safeguards for transferring personal data to another country.
GDPR Art. 46(2)(c) allows transfers on the basis of standard data protection clauses adopted by the European Commission. The current EU set, Implementing Decision 2021/914, is modular: controller to controller, controller to processor, processor to processor and processor to controller. Parties may add clauses but cannot contradict the standard text, and they must complete annexes describing the transfer and the security measures.
Brazil has its own model: ANPD Resolution CD/ANPD 19/2024 approved Brazilian standard contractual clauses for transfers under LGPD Art. 33, which must also be adopted without changes to their substance. The EU and Brazilian sets are separate instruments, so a group transferring data from both regions may need both.
Signing the clauses is not the end of the exercise. Under the GDPR, the exporter documents a transfer impact assessment and adds supplementary measures, such as encryption, where the destination's laws could prevent compliance. Example: a European company using an analytics vendor in a non-adequate country signs the controller-to-processor module and records its assessment.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 5: International transfers and vendors.
Primary sources
- GDPR Art. 46(2)(c)
- Commission Implementing Decision (EU) 2021/914
- Resolução CD/ANPD nº 19/2024