Standard Contractual Clauses: Modules and Annexes

Standard contractual clauses (SCCs) are model contract clauses that the European Commission has pre-approved so that they can serve as a ground for transferring personal data from the EU to a third country under the GDPR. For research teams, the practical questions are which of the four modules matches the roles in a collaboration, what the parties may and may not change in the text, what goes in the annexes, and how the transfer impact assessment fits in. This page works through those, as described on the Commission’s official pages on 2026-10-29. It is general information, not legal advice.

What standard contractual clauses are and who issues them

The Commission describes SCCs as model contract clauses it has pre-approved, usable as a ground for transfers from the EU to third countries under the GDPR. The current set was issued on 4 June 2021 as Commission Implementing Decision (EU) 2021/914. It replaces the three sets of SCCs adopted under the earlier Directive 95/46 (European Commission, SCC page).

SCCs are one of several transfer tools. The site’s entry on GDPR Article 44 international data transfers places them within the wider Chapter V framework, and the GDPR compliance guide for research shows where transfers sit in a research data protection programme.

Who can use them: scope

According to the Commission, the modernised SCCs cover transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA and not subject to the GDPR. The Commission also states that it is developing further sets, for transfers to EU institutions and bodies and for importers whose processing is directly subject to the GDPR.

The UK and Switzerland have endorsed the EU SCCs with limited adaptations. The Commission page also lists other frameworks, including the Council of Europe’s Convention 108+, the Ibero-American Data Protection Network and the ASEAN Model Contractual Clauses (a joint ASEAN MCC and EU SCC guide was published on 24 May 2023).

What the clauses require: four modules and general clauses

Per the Commission’s Questions and Answers document, the SCCs combine general clauses that apply in every case (for example Section I) with four modules. The parties choose the module that matches their roles. The Q and A’s own examples map well onto research collaborations.

Module	Roles	Example in the Commission Q and A	Research reading
Module 1	Controller to controller	A Swedish travel agency sharing data with a hotel chain	Two institutions that each decide why and how they use shared participant data
Module 2	Controller to processor	A Dutch company outsourcing HR to a provider in India	A sponsor or university engaging a non-EU service provider to process data on its instructions
Module 3	Processor to sub-processor	A Polish lab sending data to an Indonesian genetic-analysis institute	A processor passing work to a further non-EU laboratory
Module 4	Processor to its controller	A Belgian research institute returning survey data to a university in Tunisia	A processor sending results back to a non-EU controller

The right-hand column is this page’s reading of the roles; the examples and module definitions come from the Commission’s document. Role allocation is a legal question that depends on the facts of each project. The site’s comparison of a data sharing agreement versus a data processing agreement and its guide to data sharing agreements between collaborators and institutions cover the controller and processor distinction in more depth.

Article 28 is built in

For controller-to-processor and processor-to-sub-processor transfers, the Commission states that the Article 28 GDPR requirements have been incorporated into the SCCs, so companies do not need to sign a separate contract to comply with Article 28. This is distinct from Decision (EU) 2021/915, which is a different set of clauses and is not the transfer instrument.

What you may change and what loses reliance

The text is fixed. The Commission’s Q and A says that if the parties change it beyond choosing the relevant modules and options and filling in square brackets and annexes, the clauses may no longer be used as a transfer basis unless a national data protection authority approves them as ad hoc clauses under Article 46(3)(a).

Action	Effect as described by the Commission
Choose the relevant module and options; fill in square brackets and annexes	Permitted
Delete modules and options that do not apply	Expected: the Q and A says non-applicable modules and options should be deleted
Add further clauses, or embed the SCCs in a broader contract	Permitted as long as the other provisions do not contradict the SCCs, directly or indirectly, or prejudice data subjects’ rights
Agree the optional docking clause	Permitted: additional parties may join later; a joining party completes the annexes and signs Annex I
Alter the clause text itself	May no longer be usable as a transfer basis unless approved by a national authority as ad hoc clauses (Article 46(3)(a))

Steps to put SCCs in place

Map the transfer. EDPB Recommendations 01/2020 begin with knowing your transfers and then identifying the transfer tool you rely on.
Pick the module from the roles of exporter and importer (table above).
Complete the annexes. The Q and A names Annex I.A (parties), I.B (description of the transfer), I.C (competent supervisory authority) and Annex II (technical and organisational measures). Under Clause 13, an EEA-established exporter names the authority competent for the exporter in Annex I.C.
Assess the destination country (Clause 14). Following the Schrems II judgment (C-311/18), the parties assess, before concluding the SCCs, whether the destination country’s laws and practices could prevent the importer from complying. The Q and A lists factors including the categories and format of the data, the type of recipient, the economic sector, and the length of the processing chain, measured against the limits and safeguards in light of the objectives in Article 23(1) GDPR. Document the circumstances, the destination laws and any additional safeguards.
Add supplementary measures if needed. EDPB Recommendations 01/2020 (Version 2.0, adopted 18 June 2021) set six steps: know your transfers; identify your transfer tools; assess whether the Article 46 tool is effective in light of all circumstances; adopt supplementary measures; take procedural steps if you have identified effective measures; re-evaluate at appropriate intervals. Annex 2 of the Recommendations gives examples of supplementary measures.
Sign, and add the docking clause if more parties may join.

Two importer duties continue after signature. Under Clause 15 the importer must promptly notify the exporter, and the data subjects where possible, of public-authority access requests, review their legality and challenge unlawful ones. Under Clause 14(e) the importer notifies the exporter if it later becomes subject to laws not in line with Clause 14(a).

Typical timeline phases

The phases below describe sequence, not duration, which varies by project.

Inventory of transfers and roles.
Module selection and annex drafting with the receiving institution.
Transfer impact assessment and any supplementary measures.
Signature, then onboarding of any joining parties through the docking clause.
Periodic re-evaluation, and a fresh look when the processing is modified or the destination country’s law changes.

On transition, the Commission says agreements concluded after 27 September 2021 must use the new SCCs, and contracts signed earlier under the old SCCs had until 27 December 2022 to switch (earlier if the processing is modified). After 27 December 2022 it is no longer possible to rely on the previous SCCs.

Common mistakes

Editing the clause text. Rewording a clause, as opposed to completing the brackets and annexes, risks losing SCC status.
Leaving unused modules in the signed document. The Q and A says inapplicable modules and options should be deleted.
Skipping the destination-country assessment. Clause 14 requires it before the SCCs are concluded.
Treating a side agreement as an override. Additional provisions may not contradict the SCCs directly or indirectly.
Using an obsolete set. Contracts on the old SCCs can no longer be relied on after 27 December 2022.
Confusing instruments. Decision (EU) 2021/915 (Article 28 clauses) is not the transfer SCC decision, and China’s cross-border mechanism is a separate instrument (see the PIPL cross-border transfer guide).

Related transfer mechanisms

Mechanism	Summary
EU SCCs (Decision 2021/914)	Pre-approved model clauses with four modules, used as a transfer ground under the GDPR
Ad hoc clauses	Customised clauses approved by a national data protection authority under Article 46(3)(a)
Adequacy decision	Where the destination country benefits from an adequacy decision, SCCs for the transfer itself may not be needed (Commission Q and A)
UK and Swiss adaptations	Endorsed versions of the EU SCCs with limited adaptations
ASEAN Model Contractual Clauses	Separate ASEAN framework; joint guide with the EU SCCs published 24 May 2023

For a plain-language definition of the agreement that often accompanies these clauses in research, see data transfer agreement.

FAQ

Do SCCs replace a data processing agreement?

For controller-to-processor and processor-to-sub-processor transfers, the Commission says the Article 28 requirements are incorporated, so a separate Article 28 contract is not needed for that transfer.

Can we add our own clauses?

Yes, or you can embed the SCCs in a broader contract, provided nothing contradicts the SCCs or prejudices data subjects’ rights. Changing the SCC text itself is different and may remove their status as a transfer basis.