Standard Contractual Clauses (SCCs) Guide: Modules and TIAs

Standard contractual clauses are the most widely used legal route for sending personal data from the EU to countries without an adequacy decision, and they fail when they are signed as boilerplate without the assessment and controls they assume. This guide explains the clauses adopted by Commission Implementing Decision (EU) 2021/914: which of the four modules to use, what each key clause obliges the parties to do, how to run the transfer impact assessment that Clause 14 requires, and how the UK and Swiss versions differ. It also covers what the clauses mean when the "importer" is really an integration, a service account or an AI agent. It is written for privacy, security, procurement and identity teams who sign, operate or audit SCCs. For the regional picture, see the International Data Transfers Map.

Key takeaways

Pick the module from the roles. Module One is controller to controller, Two controller to processor, Three processor to processor and Four processor to controller; one relationship can use several modules.
The text cannot be edited. Parties choose modules and options, fill the annexes and may add protective terms, but nothing they add may contradict the clauses or undercut the Clause 12 liability scheme.
Clause 14 is the hard part. The parties warrant that the destination's laws do not prevent compliance, must document that assessment and make it available to the supervisory authority on request.
SCCs are suspended, not just signed. Clauses 14(f), 15 and 16 require notification of government access requests and suspension of transfers when safeguards fail, and regulators have fined companies that did not follow through.
Annex II is a security control set. The technical and organisational measures (encryption, pseudonymisation, logging, access control) are contractual promises, so they should match how credentials and machine access really work.

Scope: who and what is covered

Under Article 1(1) of Decision 2021/914, the clauses "are considered to provide appropriate safeguards" under GDPR Art. 46 for a transfer from an exporter subject to the GDPR to an importer whose processing is not subject to the GDPR. Recital 7 limits their use to that case, and the Commission's Questions and Answers repeat that they should not be used where the importer's processing is already subject to the GDPR under Art. 3(2). The Commission says it is developing additional sets of SCCs for that scenario; no adoption date has been published, so check the Commission's SCC page before relying on any new set.

A transfer exists only where all three EDPB criteria in Guidelines 05/2021 are met: the exporter is subject to the GDPR for the processing, it discloses or makes data available to another controller or processor, and that importer is in a third country. Remote access by your own employee abroad is not a transfer; access by a vendor's engineer abroad is.

Module	Exporter	Importer	Typical use	Notes
One	Controller	Controller	Sharing customer data with a partner or group company that decides its own purposes	Importer notifies breaches to the exporter and the competent supervisory authority (Clause 8.5(e))
Two	Controller	Processor	SaaS, cloud, payroll, support outsourcing	Includes the Art. 28 processor terms, so no separate DPA is needed for those terms
Three	Processor	Processor (sub-processor)	An EU processor using a non-EU hosting or support provider	Importer flags instructions it cannot follow; breach notice goes to the exporter and, where feasible, the controller
Four	Processor	Controller	An EU processor returning data to its non-EU customer	Lighter regime; Section III applies only where the EU processor combines the data with data collected in the EU

Key obligations

The Annex has four sections: general clauses (Clauses 1 to 7), obligations of the parties (Clauses 8 to 13), local laws and government access (Clauses 14 and 15) and final provisions (Clauses 16 to 18), followed by Annexes I to III.

Clause	What it requires	Who acts	Evidence to keep
7 Docking clause (optional)	A new party may accede "with the agreement of the Parties" by completing the Appendix and signing Annex I.A	All parties	Signed Annex I per party
8 Data protection safeguards	Purpose limitation, transparency, accuracy, storage limitation, security, onward transfer limits, breach notification "without undue delay"	Importer	Processing records, breach log, onward transfer agreements
9 Sub-processors (Modules Two and Three)	Option 1 specific prior authorisation; Option 2 general authorisation from an agreed list with written notice of changes; time periods are blanks to fill	Importer and exporter	Sub-processor list, notice and objection records
10 to 12 Rights, redress, liability	Data subjects are third-party beneficiaries; complaint routes; liability between parties and towards data subjects	Both	Request handling records
13 Supervision	The competent supervisory authority is the one named in Annex I.C	Exporter	Annex I.C completed
14 Local laws and practices	Warranty of "no reason to believe" local law prevents compliance; assessment of the factors in 14(b); documentation (14(d)); notice of change (14(e)); suspension (14(f))	Both	Transfer impact assessment, review dates
15 Government access	Notify the exporter and, where possible, the data subject of legally binding requests or direct access; review legality and challenge unlawful requests	Importer	Request register, legal reviews
16 Non-compliance and termination	Importer "shall promptly inform" the exporter if it cannot comply; exporter suspends and may terminate	Both	Suspension decisions
17 and 18 Governing law and forum	Law of an EU Member State that allows third-party beneficiary rights, and EU Member State courts (Module Four: a country allowing such rights)	Both	Completed options

The transfer impact assessment

Clause 14(b) lists three factors: the specific circumstances of the transfer (including the length of the processing chain, the categories of data and the type of recipient), the laws and practices of the destination including those on disclosure to public authorities, and any additional contractual, technical or organisational safeguards. EDPB Recommendations 01/2020 (version 2.0, adopted 18 June 2021) turn this into six steps:

Know your transfers: map each flow, including onward transfers and remote access, and confirm the data is limited to what is necessary.
Identify the transfer tool: adequacy, the DPF for certified US recipients, SCCs, BCRs or a derogation.
Assess the tool's effectiveness: review the destination's laws and practice. The importer's documented experience of past requests can be used only alongside other reliable information, and the absence of past requests is not decisive on its own.
Adopt supplementary measures: technical (encryption with keys the importer cannot reach, pseudonymisation), contractual (transparency and challenge commitments) and organisational (access policies, data minimisation).
Take procedural steps: where measures change the clauses or a non-SCC tool is used, consult the supervisory authority as required.
Re-evaluate at appropriate intervals: "Accountability is a continuing obligation," in the EDPB's words.

The EDPB recommends a detailed written report covering the legal assessment, the procedure, the people involved, the dates of checks and endorsement by the exporter's legal representative.

Choosing SCCs or another route

Adequacy or DPF first: if the destination is adequate, or the US recipient is on the DPF list, SCCs are not needed. Keep SCCs signed as a fallback for US vendors in case the DPF falls. See the EU-US Data Privacy Framework Guide.
BCRs for large groups: a multinational with many intra-group flows may prefer approved BCRs to dozens of intra-group SCCs, at the cost of a long approval. See the Binding Corporate Rules (BCRs) Guide.
SCCs for vendors and partners: the default for processors and third parties outside adequate countries. Small organisations usually accept the vendor's SCC pack, but should still check the module, Annex II and the sub-processor option.
Derogations only for occasional flows: Art. 49 grounds such as explicit consent are interpreted narrowly and are not a basis for regular, systematic transfers.

UK and Swiss versions

For UK GDPR transfers the EU SCCs alone are not valid. Use the UK International Data Transfer Agreement (IDTA) or the UK Addendum attached to the EU SCCs, both in force since 21 March 2022. Old EU SCCs could be used in new UK contracts only until 21 September 2022 and in existing ones until 21 March 2024. The Addendum suits groups already using EU SCCs; the IDTA is a standalone agreement that also works where the importer is directly subject to the UK GDPR. Both need a transfer risk assessment, which the ICO's January 2026 guidance aligns with the Data (Use and Access) Act test that protection is "not materially lower" after transfer. Switzerland accepts the EU SCCs with limited adaptations for Swiss law, as the Commission's SCC page notes. See the UK GDPR and Data Protection Act 2018 Guide and the Switzerland nFADP Guide.

Timeline and current status

16 July 2020: the CJEU in Schrems II (C-311/18) invalidated the Privacy Shield and upheld the 2010 SCC decision, but required exporters to verify protection in the destination and suspend transfers if it could not be ensured.
4 June 2021: the Commission adopted Decision 2021/914; it entered into force on 27 June 2021.
27 September 2021: the previous SCC decisions (2001/497/EC and 2010/87/EU) were repealed for new contracts.
27 December 2022: end of the transition for contracts concluded under the old clauses, provided processing had not changed.
25 May 2022: the Commission published its Questions and Answers on the SCCs, described as a dynamic document.
October 2026: the 2021 SCCs remain in force; additional SCCs for importers subject to the GDPR are in preparation with no published date.

Enforcement and penalties

Transfer breaches fall in the higher GDPR tier (Art. 83(5)): up to EUR 20 million or 4% of worldwide annual turnover, and authorities can order suspension of flows under Art. 58(2)(j).

Meta Platforms Ireland, EUR 1.2 billion (decision 12 May 2023): the Irish DPC found that Meta's use of the 2021 SCCs with supplementary measures did not address the risks identified by the CJEU, in breach of Art. 46(1). Signing the current clauses was not enough; the assessment and the measures had to work.
Uber, EUR 290 million (August 2024): the Dutch Autoriteit Persoonsgegevens found that Uber transferred drivers' data to the US for over two years without a transfer tool after it stopped using SCCs in August 2021. The lesson is that removing SCCs when the legal landscape changes leaves flows with no basis at all.

What it means for AI agents and non-human identities

SCCs describe data flows between legal entities, but the flows themselves run on credentials. Annex I's description of the transfer and Annex II's measures should reflect that.

Describe machine access in Annex I: list the access method (API, SFTP, OAuth integration, agent tool call), the systems and the data categories each credential reaches, so the description matches reality when an auditor compares it with logs.
Make Annex II concrete for credentials: commit to vaulted secrets, short-lived tokens, least-privilege scopes, key rotation and logging of machine access, rather than generic "access control" wording. See the Secrets Management Guide and the API Key Management Guide.
Treat integration tokens as onward transfer paths: a vendor's integration that pulls data into its own platform is an onward transfer under Clause 8. The Salesloft Drift breach shows how one integration token can expose CRM data across many customers.
Agents and model providers are sub-processors: if a processor's AI agent sends personal data to a model provider outside the EU, that provider must appear in the Clause 9 sub-processor list and is covered by Module Three. See the AI and GDPR Guide.
Encryption as a supplementary measure depends on key custody: encryption counts only if the importer and destination authorities cannot obtain the keys, so the identities that administer the key management service are part of the transfer assessment. See the Cryptographic Key Management Guide.

Compliance steps

Inventory flows (weeks 1 to 4): from the record of processing, list every recipient outside the EEA, its role, country, data categories and access path, including service accounts and integrations. Start with the Data Mapping and ROPA Guide.
Filter and route (weeks 3 to 6): remove flows that are not transfers, move adequate and DPF-certified recipients to their own track, and assign the SCC module to the rest.
Complete the contract pack: select Clause 9 option and notice period, Clause 17 and 18 choices, and fill Annexes I to III per transfer. Do not edit the clause text; add commercial terms in a separate agreement that does not contradict it.
Run and document the assessment: use one template per destination country and reuse it across vendors, adding vendor-specific facts (chain length, data, access paths, request history).
Pilot with your highest-risk vendor: test whether Annex II measures are true by checking key custody, token scopes and access logs against the contract before rolling the template out.
Operate: route Clause 14(e) and 15 notices to the privacy team, track sub-processor changes, and set annual review dates.
Plan the rollback: for each critical flow, record how you would suspend it under Clause 16 (revoke the integration, rotate keys, switch region) and test that path once a year.

Measuring it

Coverage: percentage of non-EEA recipients in the ROPA with a valid mechanism and a current assessment (target 100%).
Freshness: assessments older than 12 months or past a trigger event.
Annex accuracy: machine credentials reaching non-EEA recipients that are not described in Annex I.
Sub-processor latency: days between a vendor's change notice and your review decision.
Suspension readiness: critical flows with a tested suspension path.

Common failure patterns

Signed but never assessed: the SCC pack is in the contract but no Clause 14 assessment exists, which is the gap the Meta decision turned on.
Wrong module: using Module Two for a vendor that also uses data for its own purposes, so the controller obligations are missing.
Edited clauses: liability caps or "precedence" terms in the master agreement that undercut Clause 12 or the third-party beneficiary rights.
Generic Annex II: measures copied from a template that do not match how the vendor's service accounts and keys are actually managed.
Dropped mechanism: removing SCCs on a legal change and not replacing them, as in the Uber decision.
Invisible onward transfers: sub-processors and AI model providers added by the vendor without notice under Clause 9.

Framework mapping

Framework	Reference	Relevance to SCCs
NIST CSF 2.0	GV.OC-03, GV.SC-05, ID.AM-07	Legal requirements, supplier contracts, data inventories
NIST SP 800-53 Rev. 5	SA-9(5), PT-2, SC-8, SC-12, AU-2	Service location, authority to process, transit protection, key management, logging
ISO/IEC 27001:2022 Annex A	5.20, 5.31, 5.34, 8.24	Supplier agreements, legal requirements, PII protection, cryptography
CIS Controls v8.1	Control 3, Control 15	Data protection and service provider management

Practitioner checklist

Every non-EEA recipient has a module assigned from its actual role.
Clause text is unedited; commercial terms sit outside and do not contradict it.
Annex I describes machine access paths and data per credential.
Annex II measures are verified against the vendor's real key and token practices.
A documented Clause 14 assessment exists per destination, with a review date.
Clause 9 option and notice period are set, and sub-processor changes are tracked.
Government access notices under Clause 15 have an owner and a register.
UK flows use the IDTA or Addendum; Swiss flows carry the Swiss adaptations.
Each critical flow has a tested suspension path.

Standards and references

Related NHI Mgmt Group resources: International Data Transfers Map · GDPR Compliance Guide for Security Teams · Third-Party Risk Management Guide · DPIA Guide: Running a Data Protection Impact Assessment. This guide summarises the EU standard contractual clauses and related UK and Swiss instruments as of October 2026 and is not legal advice.

Standard Contractual Clauses (SCCs) Guide: Modules, Transfer Impact Assessments and Use