AUG (Authorized User Group) Certified
IND Recognised Sponsor
Nasscom Certified
SNA Certified
Nasscom Certified
What Are Standard Contractual Clauses (SCCs)?
Standard Contractual Clauses (SCCs) are pre-approved legal contract templates issued by the European Commission that allow companies to lawfully transfer personal data from the EU to countries outside the European Economic Area that don't have an “adequacy” decision. They are the most commonly used legal mechanism for cross-border data transfers under GDPR.
SCCs aren't a single fixed document; the European Commission's 2021 modular version has different clauses depending on whether the transfer is controller-to-controller, controller-to-processor, processor-to-processor, or processor-to-controller.
Standard Contractual Clauses at a Glance
| Attribute | Description |
|---|---|
| Legal Basis | Article 46(2)(c), GDPR |
| Issued By | The European Commission |
| Current Version | 2021 modular SCCs, covering four transfer scenarios |
| Used For | Transferring personal data outside the EEA without an adequacy decision |
| Additional Requirement | Often paired with a Transfer Impact Assessment (TIA) |
| Common Use Case | US-based companies receiving EU employee data from an EOR or HR platform |
Why Does It Matter?
Whenever EU personal data needs to flow to a country the European Commission hasn't deemed “adequate” for data protection, such as most non-EU countries, companies need a valid legal transfer mechanism. SCCs are the standard tool for this, and using outdated clauses or skipping a transfer impact assessment is a common compliance gap that regulators actively check during audits.
When Is It Used?
SCCs become relevant whenever a company:
- Transfers EU employee or candidate data to a parent company, vendor, or service provider outside the EEA.
- Sets up an Employer of Record or payroll relationship that involves data flowing to a non-EU headquarters.
- Needs to document a legal basis for cross-border data transfers as part of GDPR compliance.
A US company hires employees across the EU through an Employer of Record and needs employee payroll data reported back to its US headquarters for consolidated reporting. To lawfully transfer that data outside the EEA, the company and the EOR incorporate the European Commission's 2021 SCCs into their data processing agreement, along with a transfer impact assessment.
Common Misconceptions
No. Only specific legal mechanisms, including SCCs, adequacy decisions, or binding corporate rules, satisfy GDPR's rules on international data transfers.
No. Since the 2020 Schrems II ruling, companies using SCCs are generally expected to also conduct a transfer impact assessment evaluating the destination country's surveillance laws.
No. The European Commission's 2021 modular SCCs replaced earlier versions, and companies using outdated clauses risk non-compliance.
No. Any company, regardless of size, transferring EU personal data outside the EEA needs a valid transfer mechanism.
Standard Contractual Clauses are the European Commission's pre-approved legal templates enabling lawful transfer of personal data outside the EEA, and they remain the most widely used mechanism for this purpose. Companies moving EU employee data internationally, often through EOR or payroll relationships, need current SCCs paired with a documented transfer impact assessment.
Transferring EU employee data?
We'll put current SCCs and a documented transfer impact assessment in place for your cross-border hires.
experts@adtsolution.com
Queens towers, Delflandlaan 1, 1062 EA Amsterdam, The Netherlands
