According to the EU General Data Protection Regulation (GDPR), contractual clauses ensuring appropriate data protection safeguards might be used as legal basis for data transfers from the EU to third countries. This includes model contract clauses – so-called standard contractual clauses (SCCs).

The EU Commission has issued modernised SCCs under the GDPR for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR). According to the EU Commission’s press release, the modernised SCCs reflect new requirements under the GDPR, take into account the Schrems II judgement of the European Court of Justice and shall ensure a high level of data protection. These modernised SCCs replace the previous sets of SCCs that were adopted under the EU Data Protection Directive 95/46.