Standard contractual clauses

Contract terms adopted by the European Commission that allow personal data to be transferred from the EU to a country without an adequacy decision (GDPR Article 46(2)(c)).

The current clauses were adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. They come in four modules for different relationships: controller to controller, controller to processor, processor to processor, and processor to controller. The clauses may not be changed, but they can form part of a wider contract.

Since the Schrems II judgment, parties relying on them are expected to assess whether the law of the destination country lets the importer comply, and to add supplementary measures where needed. The clauses require that assessment to be documented (Clause 14): it is the transfer impact assessment.

Source: Commission Implementing Decision (EU) 2021/914 ↗

ClauseTrail watches vendors' subprocessor lists, DPAs, privacy policies, terms and AI terms, and tells your team what changed and by when to object.