Standard contractual clauses (SCCs) are a set of pre-written contract terms, adopted by the European Commission, that a company signs with a partner outside Europe so that personal data can leave the European Economic Area (EEA) lawfully. They exist because the General Data Protection Regulation (GDPR) bans transfers to countries whose laws the Commission has not judged equivalent to European protection, unless the exporter puts "appropriate safeguards" in place. The clauses are the most widely used of those safeguards. They extend European obligations to the recipient by contract and let the people whose data travels enforce them.

For advertising, the clauses sit beneath many cross-border flows of tags, logs, audience lists and campaign reports, and they are the fallback whenever the EU-US Data Privacy Framework is in doubt.

How the clauses work

Chapter V of the GDPR sets out a hierarchy. If the Commission has issued an adequacy decision for the destination under Article 45, data can flow without extra paperwork. If not, Article 46 lists safeguards, and Article 46(2)(c) names "standard data protection clauses adopted by the Commission". Only if no safeguard is available can an exporter turn to the narrow derogations of Article 49, such as explicit consent for an occasional transfer.

The current text is Commission Implementing Decision (EU) 2021/914, adopted on June 4, 2021 and in force from June 27, 2021. It is built as a single document with four modules, according to the Commission's questions and answers page: controller to controller (Module 1), controller to processor (Module 2), processor to processor (Module 3) and processor to controller (Module 4). An advertiser using a US analytics vendor as its processor would use Module 2; one sharing conversion data with a platform that decides its own uses would use Module 1.

The parties pick the relevant module, then complete three annexes: Annex I lists the parties and describes the transfer (categories of data and people, purposes, retention), Annex II lists technical and organisational security measures, and Annex III lists sub-processors where needed. An optional docking clause (Clause 7) lets new parties join an existing contract with everyone's consent, which suits ad tech supply chains where vendors change often.

The Commission says the clauses "may not be altered" beyond choosing modules and options, filling in brackets and annexes, or adding safeguards that raise protection. Any other change strips the contract of its status as a transfer tool unless a data protection authority approves it as ad hoc clauses.

Two clauses carry most of the weight after 2020. Clause 14 requires both parties to assess, before signing, whether the laws and practices of the destination country could stop the importer from honouring the contract. This document is usually called a transfer impact assessment (TIA). If the answer is negative, the transfer may proceed only with supplementary measures, such as encryption with keys held in Europe, and the exporter must suspend it if no adequate safeguard can be found. Clause 15 obliges the importer to notify the exporter of legally binding requests from public authorities, to challenge unlawful requests, and to document what it did.

SCCs are rarely negotiated in advertising; platforms incorporate them by reference. Google said that starting August 12, 2020 it would rely on the Commission's clauses for advertising and measurement data leaving the EEA, the UK and Switzerland, building them into both its Google Ads Data Processing Terms and its controller-to-controller terms, according to its advertising policy help page.

From 2001 to Schrems II

The clauses predate the GDPR by 17 years. Article 26(4) of the 1995 Data Protection Directive (95/46/EC) allowed the Commission to approve contract terms as adequate safeguards. It did so in Decision 2001/497/EC of June 15, 2001, covering transfers between controllers, added an alternative controller set in Decision 2004/915/EC, and approved controller-to-processor clauses that were replaced by Decision 2010/87/EU of February 5, 2010, which applied from May 15, 2010, according to EUR-Lex.

Nothing covered a European processor sending data to a sub-processor abroad, which is how much of cloud and ad tech works. After the Court of Justice of the EU (CJEU) struck down the Safe Harbour decision in the first Schrems case on October 6, 2015, Implementing Decision (EU) 2016/2297 of December 16, 2016 removed limits on national regulators' powers from the old clause decisions.

The decisive moment came on July 16, 2020. In Case C-311/18, known as Schrems II, the CJEU invalidated the EU-US Privacy Shield but upheld the 2010 clauses. The court added a condition that changed how SCCs are used: a contract cannot bind the government of the destination country, so exporters must check case by case whether local law undermines it. The EDPB followed with recommendations on supplementary measures, finalised in June 2021.

The 2021 decision wrote that logic into Clauses 14 and 15 and added processor-to-processor transfers. Contracts signed after September 27, 2021 had to use the new clauses, and older contracts had to migrate by December 27, 2022.

Why the clauses matter to marketers

Between July 2020 and July 2023, with no US adequacy finding in force, EU-US advertising transfers depended largely on the clauses. The EU-US Data Privacy Framework (DPF), adopted on July 10, 2023, changed that for certified companies. Google began relying on the framework for certain EU transfers in its advertising services on September 1, 2023, and the demand-side platform StackAdapt cited the removal of any need for standard contractual clauses when it certified in early 2026.

Uncertified recipients, transfers to countries without adequacy such as China or India, and companies hedging against the DPF's collapse still depend on the clauses, and errors are costly. Ireland's Data Protection Commission fined Meta 1.2 billion euros in May 2023, following EDPB Binding Decision 1/2023 of April 13, 2023, over Facebook transfers made under SCCs without sufficient supplementary measures. That penalty, still the largest GDPR fine and still under appeal, showed that signing the clauses is not the same as complying with them.

The Dutch regulator fined Uber 290 million euros in August 2024 after finding the company had stopped using SCCs from August 2021 while storing European drivers' data in the US. In April 2025, Ireland fined TikTok 530 million euros, 485 million of it for breaching Article 46(1), after concluding that TikTok's TIAs for remote access by staff in China were inadequate even though the company used the 2010 and then the 2021 clauses.

Where the clauses fall short

The central criticism is structural. A private contract cannot restrain a foreign intelligence service, so the clauses depend on an assessment of foreign law that most exporters are poorly placed to make. Each TIA is a judgment call, and regulators can disagree with it years later. The Dutch authority found that SCCs combined with a proxy server did not suffice for Takeaway's Google Analytics transfers, issuing a reprimand for the period from August 18, 2020 to September 1, 2023.

Privacy advocates argue the clauses cannot escape the weaknesses of the adequacy regime they are supposed to back up. In July 2026, noyb argued that SCC risk assessments rely on the same American oversight bodies whose independence is now in question, so falling back on contracts would not cure the problem.

There is also a coverage gap. The 2021 clauses do not work where the importer is itself subject to the GDPR under Article 3(2), for example a US ad platform that targets Europeans directly. The Commission said it was developing a separate set for that case and planned adoption in the second quarter of 2025. That set had not been formally adopted as of May 2026, according to a legal summary by RecordingLaw. Smaller businesses complain that annexes, TIAs and sub-processor lists create paperwork without measurable protection.

Not the same as

Adequacy decisions. An adequacy decision is a Commission finding about a whole country, which removes the need for any safeguard. SCCs attach to a specific transfer between specific parties and require a TIA.

Article 28 clauses. On the same day in 2021, the Commission adopted Implementing Decision (EU) 2021/915, a separate set of standard contractual clauses for controller-processor agreements inside the EU. They govern how a processor handles data, not whether data may leave Europe.

Binding corporate rules and certification. Binding corporate rules are internal codes approved by regulators for transfers within a corporate group. Certification is another Article 46 route: the EDPB approved the Europrivacy seal as a transfer tool on April 15, 2026.

Data Act model terms. The phrase also appears in the Data Act, Regulation (EU) 2023/2854, which applied from September 12, 2025. Recommendation C(2025) 7750 of November 19, 2025 contains non-binding model contractual terms for data sharing and six sets of non-binding standard contractual clauses for cloud computing contracts, covering issues such as switching, termination and liability, according to law firm BCLP. These deal with commercial fairness between businesses, not with personal data transfers.

Recent developments

The clauses have returned to the centre of the transfer debate in 2026. On June 29, 2026, the US Supreme Court ruled in Trump v. Slaughter that Federal Trade Commission members can be removed at will, removing a protection the DPF decision cited. On July 31, 2026, EDPB chair Anu Talus asked Commissioner Michael McGrath to assess whether the judgment affects the framework. If the DPF falls, SCCs under Article 46 remain available, but every company relying on them would again need a TIA.

Disputes move slowly. The Irish High Court allowed transfers to continue while the appeal proceeds under a conditional stay granted on November 13, 2025. The Meta appeal remains open three years after the fine.

Timeline

  • October 24, 1995 - Data Protection Directive 95/46/EC adopted; Article 26(4) allows Commission-approved contract terms for transfers
  • June 15, 2001 - Decision 2001/497/EC adopts the first controller-to-controller clauses
  • December 27, 2004 - Decision 2004/915/EC adds an alternative controller-to-controller set
  • February 5, 2010 - Decision 2010/87/EU adopts controller-to-processor clauses, applicable from May 15, 2010
  • October 6, 2015 - CJEU invalidates Safe Harbour in Schrems I
  • December 16, 2016 - Implementing Decision (EU) 2016/2297 amends the 2001 and 2010 decisions on regulators' powers
  • May 25, 2018 - GDPR applies; Article 46(2)(c) carries over Commission clauses
  • July 16, 2020 - CJEU upholds the 2010 clauses but invalidates Privacy Shield in Schrems II (C-311/18)
  • August 12, 2020 - Google incorporates SCCs into its advertising data protection terms
  • June 4, 2021 - Commission adopts Implementing Decisions (EU) 2021/914 and 2021/915
  • June 27, 2021 - Decision 2021/914 enters into force
  • September 27, 2021 - New contracts must use the 2021 clauses
  • December 27, 2022 - Deadline to migrate existing contracts to the 2021 clauses
  • April 13, 2023 - EDPB Binding Decision 1/2023 on Meta's transfers
  • May 2023 - Irish DPC fines Meta 1.2 billion euros over SCC-based US transfers
  • July 10, 2023 - EU-US Data Privacy Framework adopted
  • August 2024 - Dutch authority fines Uber 290 million euros over US transfers
  • April 30, 2025 - Irish DPC fines TikTok 530 million euros over transfers to China
  • September 12, 2025 - Data Act applies
  • November 13, 2025 - Irish High Court grants TikTok a conditional stay
  • November 19, 2025 - Commission Recommendation C(2025) 7750 on Data Act model terms and cloud clauses
  • April 15, 2026 - EDPB approves Europrivacy as a transfer certification
  • June 29, 2026 - US Supreme Court decides Trump v. Slaughter
  • July 31, 2026 - EDPB asks the Commission to assess the ruling's effect on the DPF

Summary

Who: The European Commission adopts the clauses; data exporters in the EEA and importers abroad, including ad platforms, DSPs, analytics vendors and cloud providers, sign them; national data protection authorities, the EDPB and the CJEU police them.

What: Pre-approved, non-editable contract terms that provide an appropriate safeguard under GDPR Article 46(2)(c) for transferring personal data to countries without an adequacy decision, backed by a transfer impact assessment and, where needed, supplementary measures.

When: First adopted on June 15, 2001; modernised on June 4, 2021, with migration completed by December 27, 2022; a set for Article 3(2) importers was still pending as of May 2026.

Where: Any transfer of personal data from the EEA to a third country, with parallel instruments in the UK and Switzerland.

Why: Because the GDPR prohibits transfers to countries lacking equivalent protection, and contracts are the most practical way to carry European obligations to a foreign recipient when no adequacy decision applies or when one is at risk.