standardkontraktklausuler

Standardkontraktklausuler are pre-drafted contractual clauses used to ensure an adequate level of data protection when transferring personal data from the European Economic Area to countries outside the EEA. They form part of the EU framework for cross-border data transfers under the General Data Protection Regulation (GDPR) and are designed to bind the data exporter and the data importer to specific data protection obligations.

Under EU law, the European Commission publishes standard contractual clauses that cover different transfer scenarios, including controller-to-controller, controller-to-processor, processor-to-controller, and processor-to-processor transfers. When a transfer occurs to a non-adequate country, the parties typically incorporate the relevant SCCs into their data transfer agreement. The clauses address data processing purposes, scope, data categories, security, data subject rights, subcontracting (sub-processors), onward transfers, breach notification, and dispute resolution. They are intended to provide enforceable safeguards and are often supplemented by technical and organizational measures where necessary, in light of the Schrems II decision.

Implementation involves signing the SCCs as part of a data processing agreement or as an addendum to an existing contract. The transfer arrangement must reflect the actual processing activities and may require ongoing monitoring and potential updates if supervisory guidance or local law changes. While SCCs are a common tool for legal compliance, they rely on the recipient country providing protections that align with European standards and may necessitate additional safeguards in certain contexts.