Standard Contractual Clauses, Explained (2026)

Standard Contractual Clauses (SCCs) are pre-approved contract terms that make it lawful to transfer personal data out of the European Economic Area to a country without an adequacy decision. They are the most widely used transfer mechanism under the GDPR. If your business sends personal data from the EU to a vendor, affiliate, or server in, for example, the United States or India, SCCs are usually how you make that transfer legal. This guide explains what they are, the 2021 modules, how to complete them, the UK equivalents, and the assessment that must sit behind them. ## Why SCCs exist Under the GDPR, personal data may be transferred outside the EEA only if the destination provides essentially equivalent protection. The cleanest route is an adequacy decision, where the European Commission has ruled that a country's laws are adequate. Where there is no adequacy decision, the exporter needs appropriate safeguards. SCCs are the main one: a set of contractual promises, approved by the Commission, that the importer will protect the data to EU standards and that data subjects can enforce. The current set was adopted by the Commission in June 2021 and replaced the older clauses. Contracts relying on the old SCCs had to be moved to the 2021 set, so any transfer arrangement signed now should use the 2021 clauses. ## The four modules The 2021 SCCs are modular. You do not use the whole document; you pick the module that matches the relationship between exporter and importer. Getting the module right is the first and most common point of error. - Module One: controller to controller. Both parties decide their own purposes for the data.

• Module Two: controller to processor. The exporter is a controller sending data to a processor that acts on its instructions. This is the most common module for using an overseas service provider.
• Module Three: processor to processor. The exporter is itself a processor, sending data to a sub-processor abroad.
• Module Four: processor to controller. The exporter is a processor sending data back to a controller outside the EEA. You select one module, delete the others, and complete the parts that module requires. A single arrangement can involve more than one module if the data flows in more than one direction. ## How to complete the SCCs The clauses have a fixed body you must not change, plus annexes you complete: - Annex I sets out the parties, a description of the transfer (categories of data subjects, categories of personal data, any special category data, frequency, purpose, retention), and the competent supervisory authority.
• Annex II describes the technical and organisational security measures the importer will apply. This must be specific, not a copy of generic wording; regulators expect real detail.
• Annex III lists authorised sub-processors, where Module Two or Three applies. You also complete the optional choices in the body, such as the docking clause (letting other entities join later), the governing law, and the choice of forum, all of which must be an EU member state's law and courts. The golden rule: do not amend the clauses themselves. You may add other terms, as long as they do not contradict the SCCs. The SCCs can be, and usually are, incorporated into a wider data processing agreement. ## The transfer impact assessment Signing the SCCs is not enough on its own. Following the case law of the EU courts, the exporter must also assess whether the law and practice of the destination country would undermine the protection the SCCs promise, in particular government access to data. This is the transfer impact assessment (sometimes called a transfer risk assessment). If the assessment finds a risk, the parties must put in place supplementary measures, such as strong encryption, pseudonymisation, or contractual and organisational safeguards, or else not make the transfer. Document the assessment: regulators expect to see it. ## The UK: the IDTA and the Addendum The EU SCCs do not cover transfers of UK personal data, because the UK left the EU. The UK has its own tools, issued by the Information Commissioner's Office: - The International Data Transfer Agreement (IDTA), a standalone UK transfer agreement; or
• The International Data Transfer Addendum to the EU SCCs, which bolts onto the EU SCCs so a business can use one document for both EU and UK data. Most multinationals use the EU SCCs plus the UK Addendum, because it avoids maintaining two separate agreements. A UK transfer also needs its own transfer risk assessment. ## Other countries SCCs are an EU and UK concept, but the pattern is spreading. Several jurisdictions have their own standard contract rules for cross-border data, for example China's standard contract for outbound transfers, and others accept SCC-style clauses as part of their framework. Do not assume the EU SCCs satisfy every country's law; check the destination and origin rules. ## Common mistakes to avoid - Choosing the wrong module, for example using controller-to-processor when the importer is really a sub-processor.
• Amending the body of the clauses, which invalidates them. Add extra terms separately instead.
• Leaving Annex II vague, with boilerplate security wording instead of real measures.
• Skipping the transfer impact assessment, or doing it but not documenting it.
• Forgetting the UK, so UK data rides on EU SCCs with no Addendum or IDTA.
• Not updating the annexes when sub-processors or data flows change.
• Treating the SCCs as a substitute for the Article 28 processor terms, when both are needed (see the DPA pages). ## Keeping transfer paperwork current across vendors The hard part is not signing one set of SCCs. It is keeping the right module, current annexes, up-to-date sub-processor lists, and a documented assessment across every vendor that touches EEA or UK personal data, and re-papering when the law or the vendor list changes. Tracking that across many agreements by hand is slow and easy to let drift. An AI contract workspace that extracts the transfer mechanism and annex details across your vendor contracts, and flags which need updating, keeps the picture current. Adira drafts, reviews, and tracks contracts, including data transfer terms, in one place. More at Adira. The guidance above stands on its own. ## Bottom line Standard Contractual Clauses are the EU's main lawful route to transfer personal data to countries without adequacy. Use the 2021 set, pick the correct module, complete the annexes with real detail, and do not change the body. Behind them, run and document a transfer impact assessment and add supplementary measures if needed. For UK data, add the UK Addendum or use the IDTA, with its own assessment. SCCs sit inside, not instead of, your wider data processing terms. Get specialist data protection advice for live transfers, because the law moves.