Standard Contractual Clauses

The GDPR places restrictions on the export of personal data out of the EEA/UK unless there are adequate protections in the destination country to keep its government from accessing that data (other than through legal means). Such international data transfers are only allowed under a few conditions: (1) if the destination country has been the subject of an adequacy decision by European authorities, (2) if the data importer is a U.S. business that participates in the EU-US Data Privacy Framework, or (3) via standard contractual clauses (SCCs).

SCCs are a set of contractual clauses that have been officially adopted by the European authorities as containing sufficient privacy and security guarantees for personal data. They are almost always found within the importer business's data processing agreement. To find out whether they are included in your agreement with a data importer, you can usually just search for the term “standard contractual clauses.”

Note that, while it is relatively straightforward to add the SCCs to a data processing agreement, the latest version of the clauses have some new requirements that are considerably more complicated. In response to recent court cases, European authorities added a requirement that the data exporter complete a “Transfer Impact Assessment” on the likelihood that the data could be inappropriately accessed in the destination country. These assessments must be carried out on a case-by-case basis, so they cannot be part of a boilerplate agreement. On the other hand, the Data Privacy Framework may make this easier to accomplish in the case of U.S. businesses, as the exporter can likely point to the Framework as protection against government intrusion.

This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.