Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries.
Structure
The current clauses are based on Implementing Decision (EU) 2021/914 of 4 June 2021. They have a modular structure and cover four scenarios: controller to controller, controller to processor, processor to processor and processor to controller.
The substance of the clauses must not be changed. Additions are only permitted insofar as they do not contradict the clauses.
Transfer impact assessment
Since Schrems II, the parties must assess and document whether law and practice in the recipient country prevent compliance with the clauses. Where necessary, supplementary measures such as encryption are required.
Legal provisions
- Art. 46(2)(c) GDPR
- Standard data protection clauses as an appropriate safeguard.
- Implementing Decision (EU) 2021/914
- Current standard contractual clauses for third-country transfers.
Related terms.
Schrems II Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid. CJEU, C-311/18 Third country In data protection law, a third country is any state outside the European Union and the European Economic Area. Art. 44 GDPR Data processing agreement (DPA) The data processing agreement is the contract between a controller and its processor that is required under Art. 28 GDPR. Art. 28(3) GDPR 