What are SCCs?
Standard Contractual Clauses (SCCs) are pre-approved EU contractual templates that legitimise transfers of personal data from the EU/EEA to “third countries” lacking an adequacy decision (GDPR Article 46(2)(c)). The current set is the European Commission’s Decision (EU) 2021/914 of 4 June 2021, replacing the pre-Schrems II clauses. The 2021 SCCs use a modular structure covering four transfer scenarios: controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller.
SCC modules
- Module 1: Controller-to-controller transfers.
- Module 2: Controller-to-processor (most common for SaaS).
- Module 3: Processor-to-processor (sub-processor flow-down).
- Module 4: Processor-to-controller (data return to importer).
Post-Schrems II — TIA requirement
Following CJEU C-311/18 (Schrems II), SCCs alone are not sufficient. The data exporter must conduct a Transfer Impact Assessment (TIA) evaluating the third country’s law (especially government access laws) and, where necessary, implement supplementary measures (technical: encryption, pseudonymisation; contractual: warranties, notification; organisational: policies, audits).
UK equivalent — IDTA / UK Addendum
Post-Brexit UK uses the International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs. Multi-jurisdiction transfers (e.g. EU + UK) typically use EU SCCs + UK Addendum stacked.
KVKK ve SCC
KVKK Madde 9, yurt dışı aktarımları için ya açık rıza, ya yeterli koruma kararı, ya da yazılı taahhüt + Kurul izni şartlarını arar. KVKK Kurulu, AB SCC’lerini doğrudan otomatik kabul etmez; ancak “yazılı taahhüt” yapısının altında SCC içeriklerinin KVKK gereklerini karşılayacak şekilde uyarlanması yerleşik uygulamadır. AB tarafına ihracat yapan Türk veri işleyenler için SCC Module 2 müşteri DPA’sının standart eki olur.
Do: use the 2021 SCCs (not legacy 2010 controller-to-controller clauses); attach a TIA documenting third country risk and supplementary measures.
Don’t: rely on SCCs alone for transfers to surveillance-heavy jurisdictions — Schrems II requires supplementary measures.