Standard contractual clauses: signing them is the easy half

Standard contractual clauses — SCCs — are pre-approved contract terms that provide a lawful basis for transferring personal data from the European Economic Area to a country without an adequacy decision. They are adopted by the European Commission, they come in modules covering different combinations of controller and processor, and their operative text may not be amended: you select the modules, complete the annexes and sign.

That unusual property — a contract nobody may negotiate — makes the signing straightforward and misleads people into thinking the obligation ends there. It does not. Since the invalidation of the previous transfer framework, a transfer relying on SCCs also requires an assessment of whether the law and practice of the destination country actually allow the clauses to be honoured, together with any supplementary measures that assessment shows are needed.

What signing standard contractual clauses involves

1. Establish that a transfer is happening and where the data actually goes — including remote access from outside the EEA, which is a transfer even though nothing is copied.
2. Check whether an adequacy decision covers the destination, in which case SCCs are not needed. Adequacy decisions change; verify rather than assume.
3. Select the correct module for the relationship: controller to controller, controller to processor, processor to processor, or processor to controller.
4. Complete the annexes: the parties, the description of the transfer, the technical and organisational measures, and the subprocessor list.
5. Carry out and document a transfer impact assessment for the destination.
6. Add supplementary measures where the assessment requires them — encryption with keys held in the EEA, pseudonymisation, or contractual and organisational commitments.
7. Sign, and keep the completed clauses and the assessment together.

The transfer impact assessment is the deliverable

The clauses themselves are identical for everyone, which means they say nothing about your transfer. The assessment does: what data, to which country, what public-authority access powers exist there, whether they are proportionate, whether the importer has ever received such a request, and what would happen if it did. That document is what a supervisory authority asks for, and it is the one nobody has when asked. It is also the one that has to be revisited — laws change, and so does where your processor actually hosts things.

The United Kingdom sits outside the EU SCCs: transfers from the UK use the International Data Transfer Agreement or the UK addendum to the EU clauses. Organisations operating in both frequently sign the EU set and forget the UK instrument entirely, which leaves the UK transfers with no mechanism at all.

Keeping the transfer picture current

What makes this manageable is a register rather than a pile: one row per transfer with the destination, the mechanism, the assessment date and the review date, and the executed clauses attached. Ettex Records holds that register with the assessments and signed clauses per vendor, Ettex Sheets carries the transfer inventory linked to the record of processing activities, and the contractual layer underneath is the data processing agreement the clauses attach to.

To be clear: not legal advice, and this is an area that has changed repeatedly and will again. Adequacy decisions, the status of transfer frameworks and the expectations for assessments all move; your data protection officer or counsel, and the current guidance from your supervisory authority, are the authorities.