Standard Contractual Clauses (SCCs)

What are standard contractual clauses?

Standard contractual clauses, or SCCs, are a ready-made contract approved by the European Commission. Companies sign them so they can legally send personal data from the EU to a country that lacks EU-level privacy protection, such as the US.

The GDPR only allows these transfers with a safeguard in place. Article 46(2)(c) names "standard data protection clauses adopted by the Commission" as one. The current set was issued on June 4, 2021.

The clauses come in four modules, one for each pair of roles. According to the Commission's Q&A:

• Module 1: controller to controller.
• Module 2: controller to processor, such as you and a SaaS vendor.
• Module 3: processor to processor, for example your vendor to its own subprocessor.
• Module 4: processor to controller.

What it looks like in a vendor's terms

A typical clause reads like this:

To the extent Customer Personal Data is transferred from the EEA to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses are incorporated by reference. Module Two applies where Customer is a controller and Module Three where Customer is a processor.

• "Incorporated by reference": you do not sign a separate document. Accepting the DPA brings the clauses in.
• "Without an adequacy decision": the clauses only matter where no other legal route covers the transfer.
• The modules: the vendor names which roles apply, so the right obligations kick in.

Atlassian's Data Processing Addendum works this way. Section 1.2 of its Schedule 2 brings in the SCCs and says "Module Two (Controller to Processor) applies where Customer is a Controller."

Why it matters to you

If you have users or customers in the EU, data about them likely flows to US vendors. Each step needs a valid legal basis. A path often looks like this:

1. A user in Germany signs up for your product.
2. Your app stores their data with a US cloud host.
3. Your support tool, also US-based, receives their email and messages.
4. That tool sends parts of it to its own AI subprocessor.

Each step is a transfer. If a vendor's DPA changes its transfer terms, your EU customers may ask what covers their data. Old versions also expire: the Q&A says the pre-2021 clauses could not be relied on after December 27, 2022.

What to check

• Whether the vendor's DPA includes the 2021 SCCs and names the right modules.
• Whether it covers UK and Swiss transfers too.
• Whether the vendor also relies on the EU-US Data Privacy Framework, and which route applies first.
• Whether the vendor offers a transfer impact assessment or a summary of one.
• Whether subprocessors outside the EU are bound by the same clauses.

UK International Data Transfer Addendum

The UK has its own transfer rules after Brexit. The UK Addendum is a short document that adapts the EU SCCs to UK law. The other UK option is the International Data Transfer Agreement (IDTA), a standalone contract. Both took effect on March 21, 2022, and old-style clauses stopped being valid in the UK on March 21, 2024.

Atlassian's DPA takes the Addendum route: "Each party shall be deemed to have signed the UK Addendum."

For US vendors, the UK Extension to the Data Privacy Framework, or UK-US data bridge, is a second route. It took effect on October 12, 2023. The ICO says you can rely on it only if the US company is active on the DPF list and certified to the UK Extension.

The UK's Data (Use and Access) Act 2025 changed the test for transfers to "not materially lower" protection than in the UK. Those rules took effect on February 5, 2026. Under the Act's transitional rules, existing UK Addendum and IDTA setups need no changes if they already complied.

Transfer Impact Assessment (TIA)

Read the full page on Transfer Impact Assessment (TIA)

A transfer impact assessment is a written check, done before relying on SCCs, of whether the laws in the receiving country let the importer keep its promises. It looks mainly at government access to data and whether people can enforce their rights.

It comes from the Schrems II ruling, which said companies using SCCs must assess the destination country case by case. The 2021 SCCs build it into Clause 14. The Commission's Q&A says that if the result is negative, the parties may transfer only with extra safeguards, such as end-to-end encryption, or must suspend the transfer.

The UK version is called a transfer risk assessment. The ICO says you must complete one before relying on safeguards such as the IDTA.

As a vendor's customer, you are often the data exporter, so ask the vendor for its assessment and keep a copy.

Adequacy Decision

Read the full page on Adequacy Decision

An adequacy decision is a finding by the European Commission that a country protects personal data to an EU-level standard. Under GDPR Article 45, data can then flow there without "any specific authorisation," so no SCCs are needed.

As of October 2026, the Commission's adequacy list includes Andorra, Argentina, Brazil, Canada (commercial organizations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the UK, Uruguay and the European Patent Organisation. The UK decisions were renewed on December 19, 2025, and Brazil's was adopted on January 27, 2026.

The US is a special case. Its adequacy decision covers only companies certified under the EU-US Data Privacy Framework. For an uncertified US vendor, you still need SCCs. Article 45 also requires a review at least every four years.

Binding Corporate Rules (BCRs)

Read the full page on Binding Corporate Rules (BCRs)

Binding corporate rules are a company group's own internal privacy rulebook, approved by an EU data protection authority. Once approved, they let the group move personal data between its own companies around the world.

GDPR Article 47 sets the bar. The rules must bind every group member and its staff, give people enforceable rights, and make an EU-based group company accept liability for breaches by members outside the EU. They are also one of the safeguards listed in Article 46(2)(b).

Approval runs through the EU authorities' joint review process, so BCRs suit large groups with many companies. If a vendor relies on them, ask which group companies they cover. BCRs cover only transfers inside the group, so subprocessors outside it still need SCCs or another route.

How Venpo helps

Venpo monitors your vendors' DPAs, subprocessor lists and privacy policies and emails you when their transfer terms change, such as a new SCC module, a dropped UK Addendum or a subprocessor in a new country. Each vendor's change history shows how its transfer terms moved over time.