Standard Contractual Clauses (SCCs) for Cross-Border Data (2026)

What are Standard Contractual Clauses, and when do you need them? Standard Contractual Clauses (SCCs) are pre-approved contract terms that let you transfer personal data out of the EU/EEA to a country without an adequacy decision, while keeping GDPR-level protection. They are one of the Article 46 "appropriate safeguards". If you send personal data to a country the European Commission has not found adequate, you generally need SCCs (or another valid safeguard) in place before the transfer. The current EU SCCs were adopted by the European Commission on 4 June 2021 (Implementing Decision (EU) 2021/914) and became the only valid version for new arrangements. The old 2001/2010 SCCs stopped being valid for existing arrangements from 27 December 2022. Last verified October 2026. This article is general guidance, not legal advice. Data-transfer law changes, so check the Commission's and the ICO's current pages and take advice before relying on a specific mechanism. ## The four modules The 2021 EU SCCs are built as four modules, one for each combination of the parties' roles. You pick the module that matches your transfer: | Module | Exporter | Importer |

|--------|----------|----------| | 1 | Controller | Controller | | 2 | Controller | Processor | | 3 | Processor | Processor | | 4 | Processor | Controller | You use only the module that fits, complete the annexes, and sign. Annex I describes the parties and the transfer, and Annex II sets out the technical and organisational security measures. Signing the modules without completing the annexes and the transfer impact assessment is not compliance. ## The transfer impact assessment The 2021 SCCs require the parties to assess whether the law of the destination country stops the importer from meeting its obligations, and to add supplementary measures where needed. This transfer impact assessment (TIA) is part of using SCCs correctly, not an optional extra. Keep a written TIA per importer, and record the supplementary measures (for example strong encryption) you rely on. ## The UK: IDTA and the Addendum The UK left the EU regime, so the EU SCCs alone do not cover UK personal data. Since 21 March 2022 the UK has two routes, both issued by the ICO: - The International Data Transfer Agreement (IDTA), a standalone UK document; and

• The UK Addendum to the EU SCCs, which attaches to the 2021 EU SCCs and swaps in UK terminology and legal references. A common mistake is a US or other importer signing only the 2021 EU SCCs for data that includes UK personal data; that leaves no valid UK safeguard until the UK Addendum or the IDTA is also executed. Note too that the IDTA does not itself contain the Article 28 processor terms, so those must sit in a separate linked agreement. ## Switzerland Switzerland mirrors the 2021 clauses. You can use the Swiss Federal Council's own SCCs, or the EU SCCs with a Swiss adaptation annex referencing the Swiss data-protection law and the Swiss regulator. ## The US: the Data Privacy Framework and its 2026 status For transfers to the US, the EU-US Data Privacy Framework (DPF) adequacy decision has been in force since 2023, with a UK Extension and a Swiss arrangement added afterwards. If your US importer is certified under the DPF, you may rely on it instead of SCCs. The DPF faces live challenges. The General Court upheld it in September 2025, and an appeal (the Latombe case, C-703/25 P) is pending before the Court of Justice. Separately, a 2026 US Supreme Court ruling on the removal of FTC Commissioners prompted the EDPB chair to ask the Commission in mid-2026 to assess whether the FTC remains independent enough to support adequacy. As of October 2026 the adequacy decision remains in force and certified importers can still receive EU data, but the position could change. <!-- [VERIFY: current status of DPF adequacy and case C-703/25 P] --> The prudent fallback is to keep SCCs plus a TIA ready per US vendor in case adequacy is suspended. ## India and other countries India's Digital Personal Data Protection Act, 2023 does not use an EU-style SCC regime; it handles cross-border transfer through its own rules (for example restrictions on transfers to notified countries). So "SCCs" in the EU/UK sense are not the Indian mechanism; check the DPDP rules for India-origin data. <!-- [VERIFY: India DPDP cross-border transfer mechanism as operationalised by the 2025 Rules] --> ## Common mistakes to avoid - Signing SCCs but leaving the annexes blank or skipping the TIA.
• Using the wrong module for the parties' roles.
• Relying on EU SCCs alone for UK data instead of adding the UK Addendum or using the IDTA.
• Forgetting that the IDTA does not include Article 28 processing terms, which must be in a linked agreement.
• Treating the DPF as permanent. Keep SCCs plus a TIA as a fallback. ## A note on jurisdiction Which mechanism you need depends on where the data starts and ends. EU/EEA exports use the 2021 EU SCCs; UK exports use the IDTA or the UK Addendum; Swiss exports use the Swiss route; US importers may use the DPF if certified; and India-origin data follows the DPDP rules, not EU SCCs. Treat "it depends on the exporting jurisdiction" as the honest default, and localise accordingly. Last verified October 2026. ## Where a contract workspace helps Picking the right mechanism is one job. The harder job is keeping it consistent: the correct module and completed annexes in every vendor contract, a TIA on file per importer, the UK Addendum attached where UK data is involved, and a fallback ready if the DPF position shifts. The drafting, review and tracking of cross-border transfer terms can also live in one AI workspace tuned to how your company moves data. It can draft from your template, link the clauses so a missing annex or a UK gap is flagged, let you edit terms in plain language, and track which contracts carry which mechanism and when to revisit them. Adira is one tool that keeps this work in a single workspace. This guide alone is enough to choose and complete the right clauses; a workspace simply makes drafting, review and tracking one connected job.