Q1: Do SCCs cover all countries outside the EU/EEA, or just the United States?

SCCs cover transfers to any third country lacking an EU adequacy decision — not just the United States. The list of countries with adequacy decisions is limited and includes jurisdictions such as the UK (under a separate adequacy finding), Canada (partially), Japan, and a handful of others. For transfers to most countries in Asia, Latin America, Africa, and the Middle East without adequacy decisions, SCCs are the primary commercial transfer mechanism. The specific risks associated with a given country — including its government access laws — are assessed through the transfer impact assessment process.

Q2: What supplementary measures may be required alongside SCCs for transfers to the United States?

Following the Schrems II decision (2020) and the invalidation of Privacy Shield, organizations transferring data to the U.S. conducted transfer impact assessments under guidance from European data protection authorities. For transfers that may be subject to U.S. national security surveillance laws (FISA Section 702, Executive Order 12333), supplementary measures such as encryption (with keys held exclusively in the EU), pseudonymization, or data minimization may be required. The EU-U.S. Data Privacy Framework (DPF), adopted in 2023, provides an alternative adequacy mechanism for transfers to certified U.S. organizations, potentially reducing reliance on SCCs for those relationships.

Q3: Can a company use its own standard contractual terms for data transfers instead of the EU Commission's SCCs?

No. Standard Contractual Clauses must use the text approved by the European Commission. A company cannot substitute its own data transfer terms, however comprehensive they may be, as a valid SCC mechanism under GDPR. Companies can use SCCs as a starting point and add supplementary provisions (in a separate annex) that do not contradict the SCC text, but the core clauses must remain unchanged. The alternative for intra-group transfers is binding corporate rules (BCRs), which require approval from a lead supervisory authority but can be tailored to the organization's specific structure. --- *Last reviewed: 2026-05-19 by LawyerAI Editorial Team.*

Standard Contractual Clauses (SCCs)

EU-approved model contract clauses for transferring personal data to countries outside the EEA; required for GDPR-compliant cross-border data transfers.

Last reviewed: 2026/05/19

Definition

Why It Matters for Lawyers

How AI Tools Handle It

Frequently Asked Questions

Q1: Do SCCs cover all countries outside the EU/EEA, or just the United States?: SCCs cover transfers to any third country lacking an EU adequacy decision — not just the United States. The list of countries with adequacy decisions is limited and includes jurisdictions such as the UK (under a separate adequacy finding), Canada (partially), Japan, and a handful of others. For transfers to most countries in Asia, Latin America, Africa, and the Middle East without adequacy decisions, SCCs are the primary commercial transfer mechanism. The specific risks associated with a given country — including its government access laws — are assessed through the transfer impact assessment process.
Q2: What supplementary measures may be required alongside SCCs for transfers to the United States?: Following the Schrems II decision (2020) and the invalidation of Privacy Shield, organizations transferring data to the U.S. conducted transfer impact assessments under guidance from European data protection authorities. For transfers that may be subject to U.S. national security surveillance laws (FISA Section 702, Executive Order 12333), supplementary measures such as encryption (with keys held exclusively in the EU), pseudonymization, or data minimization may be required. The EU-U.S. Data Privacy Framework (DPF), adopted in 2023, provides an alternative adequacy mechanism for transfers to certified U.S. organizations, potentially reducing reliance on SCCs for those relationships.
Q3: Can a company use its own standard contractual terms for data transfers instead of the EU Commission's SCCs?: No. Standard Contractual Clauses must use the text approved by the European Commission. A company cannot substitute its own data transfer terms, however comprehensive they may be, as a valid SCC mechanism under GDPR. Companies can use SCCs as a starting point and add supplementary provisions (in a separate annex) that do not contradict the SCC text, but the core clauses must remain unchanged. The alternative for intra-group transfers is binding corporate rules (BCRs), which require approval from a lead supervisory authority but can be tailored to the organization's specific structure. --- *Last reviewed: 2026-05-19 by LawyerAI Editorial Team.*

Related Concepts

Security

Data Processing Agreement (DPA)

A contract required by GDPR between a data controller and processor, governing how personal data may be handled, secured, and returned or deleted.

EU Regulation

EU AI Act (Legal Implications)

The EU's comprehensive AI regulation, in force August 2024, imposing risk-tiered obligations on AI developers and deployers — with legal sector compliance requirements escalating through 2026–2027.

Security

GDPR Compliance (AI-Assisted)

Using AI tools to identify, manage, and document compliance obligations under the EU General Data Protection Regulation across organizational data practices.

Related Tools

Legalfly
European-compliant AI legal platform with built-in GDPR safeguards for contract review and research.
Legartis
Swiss-built AI contract review tool for enterprise legal teams, with strong European data sovereignty focus.
Luminance
Enterprise AI for portfolio-level contract analysis and institutional memory.

AI Tools by Practice Context

Move from this definition to role-based legal AI shortlists and the selection criteria that matter for each type of legal team.

AI Tools for In-House Counsel
Legal department workflows: contract lifecycle, regulatory tracking, outside counsel management, and risk.
AI Tools for Big Law
Am Law 200 and global firm workflows: accuracy at scale, security compliance, and matter-level auditability.

Browse all legal AI solutions by role

Related Reading

Last reviewed: 2026/05/19. Definitions are written by the LawyerAI Editorial team. Commercial relationships are disclosed and do not determine editorial scores or conclusions. See our Sponsorship & Affiliate Disclosure.

← All glossary terms

Standard Contractual Clauses (SCCs) are pre-approved model contract provisions issued by the European Commission that provide a legal basis for transferring personal data from the European Economic Area (EEA) to countries that the European Commission has not recognized as providing an adequate level of data protection. Under the GDPR, such transfers are prohibited unless one of a specified set of transfer mechanisms is in place; SCCs are the most widely used mechanism for commercial data transfers.

The European Commission updated its SCC framework in June 2021, replacing two decades-old sets of clauses with a comprehensive new set designed to address modern data processing realities — including multi-party data transfer chains and cloud computing relationships. The new SCCs introduced four modular scenarios covering different transferor and transferee roles: controller-to-controller, controller-to-processor, processor-to-controller, and processor-to-processor. Organizations had until December 2022 to migrate existing transfer relationships to the new SCCs.

SCCs are notable for being non-negotiable in their core content: parties must use the Commission-approved text for the mandatory provisions (the "clauses" proper), though certain optional provisions can be elected and the annexes describing the transfer and processing activities must be completed by the parties. Modifications to the mandatory clause text are not permitted — doing so invalidates the SCC mechanism and leaves the transfer without a legal basis.

Data privacy lawyers advising multinational organizations face SCC obligations at significant scale. Every transfer of personal data from the EEA to a country without an adequacy decision — including, in most commercial contexts, the United States — requires either SCCs, binding corporate rules, or another approved mechanism. For companies with extensive data sharing relationships with U.S.-based vendors, cloud providers, or group entities, the SCC compliance burden can involve hundreds of separate agreements.

Beyond the mechanical question of whether SCCs are in place, the post-Schrems II legal landscape requires a "transfer impact assessment" (TIA) — an analysis of whether the laws of the recipient country provide adequate protection in practice and whether supplementary measures are needed. This analysis has added significant legal complexity to what was once a largely administrative compliance exercise. Lawyers must assess the data protection laws of each recipient country and the specific sensitivity of the transferred data.

The interaction between SCCs and data processing agreements (DPAs) under GDPR Article 28 creates additional drafting complexity. Many vendor agreements require both a DPA (governing the processor's obligations) and SCCs (governing the transfer mechanism), and the relationship between the two documents — which provisions take precedence, how data subject rights are allocated — must be carefully managed.

AI tools assist with SCC compliance primarily through contract analysis, gap identification, and document assembly. During contract review, AI identifies whether the correct SCC module is being used for a given transfer relationship, whether the annexes are complete and accurate, and whether there are discrepancies between the DPA and the SCC provisions. For large vendor portfolios, AI can classify each transfer relationship by module type and assess whether current SCCs reflect the 2021 updated version.

Some compliance platforms combine AI document analysis with regulatory monitoring — tracking European Data Protection Board guidance, national DPA decisions, and adequacy determinations that affect the SCC landscape. This is particularly valuable in a regulatory environment where significant guidance continues to emerge from EU supervisory authorities.

AI-assisted document assembly can accelerate SCC completion for high-volume implementations: generating appropriately completed annex text based on information about the transfer relationship, flagging optional provisions that may be relevant, and creating a standard workflow for SCC review and signature. This reduces the per-transaction legal cost of SCC compliance without eliminating attorney oversight of the completed documents.