Standard contractual clauses

Standard contractual clauses are a transfer tool under Article 46 GDPR. They are intended to provide appropriate safeguards when personal data are transferred to a third country and no suitable adequacy decision applies. The clauses currently used for this purpose are based on Commission Implementing Decision (EU) 2021/914.

The decision contains four modules for different role constellations: controller to controller, controller to processor, processor to processor and processor to controller. The actual allocation of roles is therefore decisive. The annexes on the data, purposes, recipients, technical and organisational measures and sub-processors must also be completed to match the processing arrangement.

Standard contractual clauses do not complete every part of a third-country transfer assessment. Before the transfer, the law and practice in the recipient country must be considered to determine whether the level of protection is essentially equivalent. Depending on that assessment, supplementary technical, organisational or contractual measures may be needed. The clauses also do not replace the controller’s or processor’s other GDPR obligations and are not a general processor agreement.

The concepts of international data transfer and transfer impact assessment provide further context. The section on processors and service providers explains the roles and contractual relationship. This helps assess whether the selected module, annexes and supplementary measures fit the actual data flow.