Glossary term
Standard Contractual Clauses (SCCs)
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: Model clauses, Model contractual clauses
Standard Contractual Clauses are pre-approved contract terms that two parties sign so that personal data can move to a country without equivalent privacy law while the recipient still promises to protect it to a set standard.
Explanation
Some data protection laws, notably the EU's GDPR, restrict sending personal data to countries judged not to give adequate protection. SCCs are one lawful route. The European Commission publishes the wording, and the exporter and importer adopt it without changing the core obligations. The clauses cover purpose limits, security, onward transfers, help with individual rights requests and the right of people to enforce them. Different modules fit different roles, such as controller to processor. Signing is not always enough: the exporter is expected to check whether the destination country's laws, including government access powers, would stop the importer keeping its promises, and to add safeguards if they would. Other countries and regional bodies publish similar model clauses. Without a valid transfer tool in place, a vendor onboarding or group-wide data sharing project can be stopped by the privacy team.
Example
A European insurer hires a claims-handling vendor whose staff in another continent will view policyholder records. The insurer attaches the controller-to-processor clauses to the contract, records the vendor's security measures, and carries out a short review of local laws on official access. Only after that does the vendor receive live data.
Not to be confused with
- Data Processing Agreement (DPA)
- A DPA sets how a processor handles data in general; SCCs are the specific clauses that legitimise a transfer abroad. Contracts often include both.