Privacy Map

European Union. Data localisation / cross-border. Commission Implementing Decision

EU SCCs 2021Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries

In force

§1Summary

Synopsis

Adopts modular standard contractual clauses (controller-to-controller, controller-to-processor, processor-to-processor, processor-to-controller) as an appropriate safeguard under GDPR Art 46. They require parties to assess third-country laws and practices (a transfer impact assessment) in line with Schrems II.

Key themes
  • SCCs
  • modules
  • transfer impact assessment
  • government access
  • docking clause
  • onward transfers
Unique features

The modular design covers processor-to-processor chains, and they include an Art 28-compliant processor contract. A Schrems II-style warranty on local laws is built in.

SaaS relevance

The default transfer tool when SaaS providers or sub-processors outside the EU and outside adequate countries process EU personal data.

§2Obligations

Breach notification
Importer must notify exporter (and authority where relevant) of breaches
Cross-border transfers
SCCs (Art 46(2)(c) GDPR)
Maximum penalty
As GDPR

§3Dates

Key dates
  • Adopted
  • In force
  • Old SCCs could not be used for new contracts after 2021-09-27 and had to be replaced by 2022-12-27. The Commission has been preparing additional SCCs for importers already subject to the GDPR under Art 3(2) (not adopted as of last check).

§4Text and authority

Text
Authority
European Data Protection Board (EDPB) / national supervisory authorities

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

I did not verify the status of the planned Art 3(2) importer SCCs.