On June 4, 2021 the European Commission adopted two sets of standard contractual clauses. Its questions-and-answers page says one set is for the relationship between controllers and processors and meets Article 28(3) and (4) of the GDPR, including for use inside the EEA. The other set is for transfers of personal data to countries outside the EEA. They are both called SCCs. They are not interchangeable.
Two documents
When a vendor attaches “the SCCs,” ask which decision. If the vendor processes for you and you need an Article 28 contract, the controller-processor clauses are the Commission’s pre-approved text for that job. If the vendor moves personal data out of the EEA, that is the transfer set, and it has modules for who is sending and who is receiving. A transfer annex does not, by itself, describe the processing instructions. A processor clause does not, by itself, solve a transfer.
What to check
- The subject matter, duration, nature, and purpose of the processing, and the type of personal data. If those annexes are blank, the clause is a shell.
- Whether the vendor is a processor, a separate controller, or both for different products. The role is not a logo.
- Sub-processors: who they are, and how you hear about a new one.
- Deletion or return at the end of the service, in a sentence you can test.
- If any data leaves the EEA, whether the transfer clauses are also attached, and which module.
FAQ
Can we edit the Commission’s text?
The Commission presents them as standardised, pre-approved clauses. Changing them can take you out of that approval. Ask counsel before you redline the model. You can and should complete the annexes. Blank annexes are the usual failure.
Does a US-only company need this?
Only if the GDPR, or a contract that imports it, applies. This page tells you how to tell the two PDFs apart. It does not decide applicability.