Which Standard Contractual Clauses (SCCs) Have Been Adopted by the European Commission?

ANSWER

On 4 June 2021, the European Commission adopted two sets of Standard Contractual Clauses (SCCs).

1. SCCs for Controller–Processor Relationships

These SCCs are designed to satisfy the requirements of:

• Article 28(3) and (4) of Regulation (EU) 2016/679 (GDPR); and
• Article 29(3) and (4) of Regulation (EU) 2018/1725 (EUDPR), the data protection regulation applicable to EU institutions, bodies, offices, and agencies.

As a result, these SCCs may be used by:

• private-sector organizations;
• public authorities; and
• EU institutions, bodies, offices, and agencies.

They provide a consistent approach to controller–processor relationships throughout the EEA.

The SCCs for controllers and processors are available here: https://ec.europa.eu/info/law/law-topic/data-protection/publications/standard-contractual-clauses-controllers-and-processors_en

2. SCCs for International Data Transfers

The second set of SCCs serves as a transfer mechanism for personal data transfers to countries outside the EEA and enables organizations to comply with the GDPR requirements for international data transfers.

These SCCs contain data protection safeguards designed to ensure that personal data continues to benefit from a high level of protection after being transferred outside the EEA.

Data exporters may rely on these SCCs without obtaining prior authorization from a supervisory authority for either:

• the transfer itself; or
• the use of the SCCs.

By adhering to the SCCs, data importers contractually commit to complying with a range of data protection obligations.

The SCCs for international data transfers are available here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en