Chapter V of the GDPR restricts transfers of personal data to countries outside the European Economic Area. A transfer needs a legal ground of its own, separate from the lawful basis for the processing. For most SaaS companies, the ground in daily use is the European Commission's standard contractual clauses, or SCCs.
SCCs look like boilerplate and are often handled that way. The clauses get attached, the annexes are left half-complete, and nobody records which module applies. The text of the clauses cannot be changed, so the annexes and the choices you make around them are where your SCCs either work or do not.
This article explains where SCCs fit, how to choose a module, what you must fill in, and what the clauses commit you to after signing.
Where SCCs sit among transfer mechanisms
Chapter V offers three routes for a transfer:
An adequacy decision under Article 45, where the Commission has decided that a country ensures an adequate level of protection. Transfers covered by the decision need no further safeguard.
Appropriate safeguards under Article 46. These include standard data protection clauses adopted by the Commission (Article 46(2)(c)) and binding corporate rules approved under Article 47.
Derogations under Article 49 for specific situations, such as explicit consent or necessity for a contract with the data subject. The EDPB reads these narrowly. They are not a substitute for safeguards on regular, repeated transfers.
For the United States, the EU-US Data Privacy Framework provides an adequacy route for transfers to organizations certified under it. Transfers to US recipients that are not certified, and to most countries without an adequacy decision, rely on SCCs.
The 2021 clauses and their four modules
The current clauses were adopted by Commission Implementing Decision (EU) 2021/914 in June 2021, replacing the earlier sets. Contracts on the earlier clauses had to move to the new ones by 27 December 2022, so any agreement still pointing at the old clauses needs replacing.
The 2021 clauses are modular. You select the module that matches the roles of the exporter and the importer:
| Module | Exporter | Importer | Typical SaaS situation |
|---|---|---|---|
| 1 | Controller | Controller | Sharing data with a partner that uses it for its own purposes |
| 2 | Controller | Processor | An EU customer using a SaaS product run from outside the EEA |
| 3 | Processor | Processor | An EU-based processor using a sub-processor outside the EEA |
| 4 | Processor | Controller | An EU-based processor returning data to a controller outside the EEA |
One agreement can include several modules when the relationship involves more than one data flow. Choosing the module is a roles question. If you have not settled whether you act as controller or processor for a flow, settle that first.
What you fill in
The body of the clauses is fixed. Your choices live in a few options and three annexes.
Options in the body
Clause 7, the docking clause, is optional. It lets new parties accede to the clauses later, which is useful in group structures.
Clause 9, use of sub-processors, applies to Modules 2 and 3. Option 1 is specific prior authorization. Option 2 is general written authorization, with notice of intended changes a specified period in advance. Fill in the period.
Clause 11, redress, includes an optional independent dispute resolution body.
Clause 13, supervision, identifies the competent supervisory authority, which depends on where the exporter is established or whether it has a representative in the EU.
Clause 17, governing law, must be the law of an EU Member State for Modules 1 to 3, and that law must allow for third-party beneficiary rights. Module 4 allows the law of another country that allows for such rights.
Clause 18, choice of forum, must be the courts of an EU Member State for Modules 1 to 3.
The annexes
Annex I lists the parties (I.A), describes the transfer (I.B), and names the competent supervisory authority (I.C). The description covers categories of data subjects and data, any sensitive data and the safeguards applied, the frequency of the transfer, the nature and purpose of the processing, the retention period, and transfers to sub-processors.
Annex II describes the technical and organizational measures, including those that help the exporter respond to data subject requests. Its explanatory note says the measures must be described in specific, not generic, terms.
Annex III lists authorized sub-processors where Module 2 or 3 is used with specific authorization.
Annex I.B should match your record of processing. If the two describe the same flow differently, one of them is wrong.
What you cannot change
Clause 2 allows you to include the SCCs in a wider contract and to add other clauses or safeguards, provided they do not contradict the SCCs, directly or indirectly, or prejudice the rights of data subjects. Clause 5 says the SCCs prevail in the event of a conflict with any related agreement between the parties.
So the clauses are not a negotiation document. Edit their text and the result is no longer the Commission's clauses, and you lose the benefit of Article 46(2)(c). Negotiate in the main agreement or the DPA, and keep those consistent with the clauses.
Clause 3 also gives data subjects third-party beneficiary rights over most of the clauses. The commitments in them are enforceable by the individuals whose data you transfer, not only by your counterparty.
The clauses that create ongoing work
Signing is the start. Several clauses require action for as long as data flows.
Clause 14, local laws and practices. The parties warrant that they have no reason to believe the laws and practices in the destination country prevent the importer from fulfilling its obligations. The warranty must rest on an assessment, documented and available to the competent supervisory authority on request. That assessment is the transfer impact assessment.
Clause 15, access by public authorities. The importer must notify the exporter of legally binding requests from public authorities, where permitted, review their legality, and challenge them where there are reasonable grounds to consider them unlawful.
Clause 8, data protection safeguards. Purpose limitation, transparency, security, restrictions on onward transfers, and, for Module 2, deletion or return at the end of the services.
Clause 9, sub-processors. Notice of changes under general authorization, and a written contract with each sub-processor imposing the same data protection obligations.
For Modules 2 and 3, the 2021 clauses are drafted to cover the processor contract requirements of Article 28(3) and (4) as well. It is still common, and often simpler, to keep a separate data processing agreement that applies to all customers, wherever they are, and incorporate the SCCs into it for transfers.
The UK and Switzerland
The UK GDPR has its own transfer regime. UK transfers use the ICO's International Data Transfer Agreement, or the UK Addendum, which adapts the EU SCCs for UK transfers. Swiss transfers can use the EU SCCs with adaptations recognized by the Swiss data protection authority. If one agreement covers EU, UK, and Swiss data, it needs to work for all three.
Transfer rules involve legal interpretation, and they move with new adequacy decisions and court rulings. Confirm your module choices and your transfer map with counsel.
How TrustLynce helps
TrustLynce's data privacy workflows record each transfer with its destination, module, and the transfer impact assessment behind it. Third-party risk management tracks which vendors receive data outside the EEA and when their agreements are due for review.