Can the Content of the SCCs Be Modified?

ANSWER

The content of the SCCs may not be modified, except for:

• selecting the applicable module(s) and/or the specific alternative options provided within the SCCs;
• completing the text where required (as indicated by square brackets), for example by specifying the competent court or supervisory authority and setting relevant time periods;
• completing the annexes; or
• adding supplementary safeguards that increase the level of data protection.

These changes are not considered prohibited modifications of the substantive SCC text.

Note for controllers and processors: If the parties modify the content of the SCCs beyond the changes described above, they can no longer rely on the legal certainty provided by the EU legal instrument.

Within the SCCs, the parties must make the necessary selections regarding:

• compliance with the GDPR or compliance with the EUDPR; and
• the use of prior specific authorization for sub-processor(s) or general written authorization for engaging sub-processor(s).

Note for international data transfers: If the parties modify the content of the SCCs beyond selecting the appropriate module(s) and/or options, completing information in square brackets, and completing the annexes, the modified clauses may no longer be used as a transfer mechanism for personal data transfers to third countries unless they are approved by a national supervisory authority as ad hoc contractual clauses pursuant to Article 46(3)(a) GDPR.