Sovereignty · Updated 10 November 2026 · 8 min read

Standard contractual clauses: what they are and when you need them

The four SCC modules, the transfer impact assessment, when an adequacy decision makes them unnecessary, and what to ask the services behind your app.

View as Markdown

Standard contractual clauses, or SCCs, are model data protection terms pre-approved by the European Commission. You need them when personal data covered by the GDPR goes to a company outside the EU and EEA that isn't itself subject to the GDPR, and the destination has no adequacy decision. If every service behind your app runs inside the EEA, or the recipient is in a country with an adequacy decision, the transfer clauses aren't needed for that step, though you still need a data processing agreement with each processor.

This page explains the rules in plain words. It isn't legal advice.

Transfer routes at a glance

Route	When it applies	Paperwork on your side
No transfer	The data stays with providers inside the EU and EEA	A data processing agreement under Article 28
Adequacy decision	The recipient's country, or a US company in the Data Privacy Framework, is covered	Check the recipient is covered, plus a processing agreement
Standard contractual clauses	A recipient outside the EEA, not subject to the GDPR, with no adequacy	The right module, filled annexes, a signed Annex I and a transfer impact assessment
Binding corporate rules	Transfers inside one corporate group	Rules approved by a data protection authority
Article 49 derogations	Occasional cases such as explicit consent	Narrow, case by case

What the clauses are

Article 46 of the GDPR says that, without an adequacy decision, a controller or processor may send personal data to a third country only with appropriate safeguards, and only if people keep enforceable rights and effective remedies. Standard data protection clauses adopted by the Commission are one of those safeguards, and they don't need a separate authorisation from a supervisory authority.

On 4 June 2021 the Commission adopted two sets:

Clauses for controllers and processors. These meet Article 28(3) and (4). You can use them between two companies inside the EU, so they aren't only about transfers.
Clauses for international transfers. These replaced the three older sets written under the 1995 directive. Contracts signed after 27 September 2021 had to use the new text, and older contracts had until 27 December 2022 to switch.

The Commission's own Q&A is clear that nobody is forced to use SCCs. They're a voluntary tool, but once you rely on them, they must be part of a binding contract.

The four modules

The transfer clauses combine general terms with four modules. You pick the one that matches each party's role.

Module 1, controller to controller. You share customer data with another company that decides how to use it.
Module 2, controller to processor. You hire a provider outside the EEA to process data for you, such as a support tool or an analytics service.
Module 3, processor to processor. Your EU hosting provider passes your data to its own subprocessor outside the EEA.
Module 4, processor to controller. An EEA processor sends data back to a client outside the EEA.

For most app builders, Module 2 is the one you sign yourself. Module 3 is the one your providers sign with their suppliers, and you see it in their subprocessor list.

When you need them

Ask these questions for every service that touches personal data, including logs, error tracking, email and support tools:

Does personal data leave the EEA? Look past the region name. Data kept in Frankfurt by a US company can still be reached from outside the EEA, so ask where support staff and connected systems sit. EU region vs EU company covers why the owner of the provider counts too.
Is the destination covered by adequacy? The Commission's list includes Andorra, Argentina, Brazil, Canada for commercial organisations, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, Uruguay, the European Patent Organisation, and US companies that take part in the Data Privacy Framework.
Is the recipient directly subject to the GDPR? The 2021 transfer clauses can't be used for a recipient whose processing already falls under the GDPR through Article 3(2). The Commission says it's preparing a separate set for that case.
Who is the exporter? If your processor sends the data on, the processor signs Module 3 with its supplier. You check that it did.

If the answers are yes, no, no, and you, then you need SCCs with that recipient.

What signing them involves

Pick the module and the options. The text can't be changed except to choose modules and options, complete the parts in square brackets, fill in the annexes, or add safeguards that raise protection. If you edit more, the clauses lose their standing as a transfer tool unless a data protection authority approves them as ad hoc clauses.
Fill in and sign Annex I. It names the parties, their roles, the data and the competent supervisory authority. The annexes are part of the clauses.
Do a transfer impact assessment. Under Clause 14, both parties confirm, when they agree to the clauses, that they've checked whether the destination's laws and practices could stop the recipient from honouring the clauses. The Q&A lists what to weigh: the data categories, the type of recipient, the sector and the length of the processing chain.
Add measures if the assessment is negative. You may only transfer with supplementary safeguards, such as end-to-end encryption, that fix the problem. The EDPB's Recommendations 01/2020 describe those measures.
Expect government access duties. Under Clause 15, the recipient must tell the exporter promptly about binding requests from public authorities for the transferred data, where its own law allows that.

SCCs and the US today

The Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. If the US recipient is certified under that framework, the adequacy decision covers the transfer and you don't need SCCs with it. The Data Privacy Framework guide goes deeper on the framework, and Schrems II explained covers the ruling that led to it. The Commission adds that the US safeguards on intelligence access apply to every GDPR transfer to US companies, whatever tool is used, which also supports transfers under SCCs to US companies outside the framework.

A provider's terms may mention both routes. Read which one covers your data, and keep a copy for your records.

Where Eurobase fits

Eurobase is a business registered in Warsaw, Poland. Your apps, logs and files are hosted on European infrastructure run by Scaleway, a French provider, so deploying on Eurobase doesn't by itself send them outside the EEA. The subprocessor list shows where a transfer can happen, and subprocessors explained shows how to read one: GitHub and GitLab Inc. are US subprocessors used only when you connect them, and Stripe handles billing. Codeberg, a German association, is a European alternative for your source code.

The list says restricted transfers use an adequacy decision, the EU standard contractual clauses, UK transfer terms where they apply, or another lawful mechanism. Eurobase's privacy page says you can ask privacy@eurobase.dev for the current safeguard details. The DPA covers the processor relationship and requires matching data protection terms with every subprocessor. Eurobase doesn't hold ISO 27001 or SOC 2 yet; both are in progress.

For the full list of what to check with a host, see the GDPR hosting checklist and hosting a SaaS with EU data.

Frequently asked questions

Do I need SCCs if my hosting provider is in the EU?

Not for that provider, as long as it's a European company and your data stays inside the EEA. You need a data processing agreement with it. Check its subprocessors, because any supplier outside the EEA needs its own transfer tool, which the provider signs.

Are SCCs still valid after Schrems II?

Yes. The 2021 clauses were written to reflect that judgment, which is why they include the transfer impact assessment in Clause 14 and the duties around government access requests in Clause 15.

Do I need SCCs with a US company in the Data Privacy Framework?

No, not for the data the certification covers. The adequacy decision is enough. Check that the company is listed and that its certification covers the kind of data you send.

Can I edit the standard contractual clauses?

Only within the choices the text offers: modules, options, square brackets, annexes and extra safeguards. You can put them inside a larger contract, but other terms mustn't contradict them.

Do SCCs work for transfers from the UK or Switzerland?

The Commission notes that both have endorsed the EU clauses with limited formal changes for their own law. Ask your provider which UK or Swiss terms it signs.