Is It Possible to Add Additional Clauses to the SCCs or Incorporate the SCCs into a Main Agreement?

ANSWER

The parties may supplement the SCCs with additional clauses or incorporate them into a broader main agreement, provided that the provisions of the main agreement do not conflict with the SCCs, either directly or indirectly, and do not prejudice the rights of data subjects.

Example:

If the SCCs require the parties to inform or cooperate with each other, the parties may agree on additional provisions specifying how such communication or cooperation will be carried out in practice.

Example:

Under the SCCs, the data importer must notify the data exporter of a personal data breach without undue delay after becoming aware of it. The parties may agree on a specific timeframe for such notification, provided that it does not undermine the general requirement. For example, they may specify that notification must be provided without undue delay and no later than 72 hours after the data importer becomes aware of the breach.

Example:

Clause 7.7 of the SCCs for controllers and processors requires the processor to obtain authorization from the controller before engaging a sub-processor. The parties may not include provisions in the main agreement allowing the processor to subcontract processing activities without consulting the controller, nor may they require the controller to grant blanket authorization for all future sub-processors. Such provisions would directly conflict with Clause 7.7 of the SCCs.