What are SCCs?
Standard Contractual Clauses (SCCs) are pre-approved EU contractual templates that legitimise transfers of personal data from the EU/EEA to “third countries” lacking an adequacy decision (GDPR Article 46(2)(c)). The current set is the European Commission’s Decision (EU) 2021/914 of 4 June 2021, replacing the pre-Schrems II clauses. The 2021 SCCs use a modular structure covering four transfer scenarios: controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller.
SCC modules
- Module 1: Controller-to-controller transfers.
- Module 2: Controller-to-processor (most common for SaaS).
- Module 3: Processor-to-processor (sub-processor flow-down).
- Module 4: Processor-to-controller (data return to importer).
Post-Schrems II: TIA requirement
Following CJEU C-311/18 (Schrems II), SCCs alone are not sufficient. The data exporter must conduct a Transfer Impact Assessment (TIA) evaluating the third country’s law (especially government access laws) and, where necessary, implement supplementary measures (technical: encryption, pseudonymisation; contractual: warranties, notification; organisational: policies, audits).
UK equivalent: IDTA / UK Addendum
Post-Brexit UK uses the International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs. Multi-jurisdiction transfers (e.g. EU + UK) typically use EU SCCs + UK Addendum stacked.
KVKK and SCCs
Since the 2024 amendment by Law No. 7499, KVKK Article 9 allows transfers abroad on the basis of an adequacy decision or, failing that, appropriate safeguards: binding corporate rules approved by the Board, standard contracts announced by the Board (which must be notified to the Authority within five business days of signature), or a written undertaking approved by the Board; occasional transfers (including with explicit consent) are possible only where none of these is available. EU SCCs are therefore not a KVKK mechanism on their own: Turkish transfers use the Board’s own standard contracts. For Turkish processors serving EU customers, SCC Module 2 is the standard annex to the client DPA.
Do: use the 2021 SCCs (not the legacy clauses under Decisions 2001/497/EC and 2010/87/EU); attach a TIA documenting third country risk and supplementary measures.
Don’t: rely on SCCs alone for transfers to surveillance-heavy jurisdictions: Schrems II requires supplementary measures.