Standard Contractual Clauses (SCCs) are pre-approved model contract terms issued by the European Commission that provide a legal mechanism for transferring personal data from the EEA to third countries that lack an adequacy decision. The current SCCs, adopted in June 2021, include modular clauses covering four transfer scenarios: controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller.
Following the Schrems II ruling, simply signing SCCs is no longer sufficient; organisations must also conduct a Transfer Impact Assessment to evaluate whether the legal framework of the recipient country undermines the protections provided by the clauses. Where gaps are identified, supplementary measures such as encryption or pseudonymisation must be implemented to ensure an essentially equivalent level of protection.