Standard contractual clauses for international data transfers

Server location is not the only criterion. Remote access from a third country, technical support, subprocessors and disclosure to a separate entity may create a transfer requiring analysis.

For each flow, the exporter, importer, roles, data categories, individuals, purpose, frequency and destination are established. If an adequacy decision applies to the recipient and transfer, SCCs may not be necessary; otherwise, the appropriate Chapter V instrument is analysed.

Decision 2021/914 contains modules for controller–controller, controller–processor, processor–processor and processor–controller relationships. An incorrect selection creates obligations misaligned with the actual roles.

• The parties: entities, contacts, roles and signatures.
• The transfer: data, individuals, frequency, purpose and retention.
• The authority: identification of the competent supervisory authority.
• Security: specific technical and organisational measures, not slogans.
• Subprocessors: the list and authorisation or notification mechanism.
• Options: the module’s clauses completed without altering mandatory protections.

The exporter assesses whether the laws and practices of the importer’s country may prevent compliance with the SCCs, considering the nature of the transfer and objective, verifiable information. The importer must cooperate by providing information about the relevant framework and experience.

Where necessary, technical, contractual or organisational measures are added: encryption with keys controlled in the EEA, pseudonymisation, minimisation, transparency and procedures for authorities’ requests. If protection cannot be ensured, the transfer must not begin or continue.

The list of subprocessors, support countries and service characteristics may change. The exporter must follow notifications and reassess the transfer when new information emerges about laws, practices or security.

The importer cannot transfer data onwards without complying with the module’s conditions and Chapter V. The agreement must allow suspension, return or deletion if safeguards cease to work.