Draft Standard Contractual Clauses Addendum

Skill: Draft Standard Contractual Clauses Addendum for Cross-Border Data Processing Agreement

1. Subject-matter triage

• Confirm the deliverable is a drafting task, not a pure review: produce the SCC addendum first, then the client cover memo.
• Identify whether the engagement includes EU/EEA data, UK data, or both; if both are in scope, plan for a separate UK transfer instrument in addition to the SCC addendum.
• Determine the legal role alignment from the DPA, MSA, and related engagement materials before selecting any clause set.

2. Failure modes the skill is correcting

• Drafting the wrong SCC module because the party roles were not confirmed from the source agreements.
• Leaving Annexes as generic placeholders instead of translating the engagement record into populated transfer terms.
• Treating security language as descriptive rather than contractual, so the final annexes do not bind specific safeguards.
• Omitting a UK transfer addendum when UK personal data is also transferred.
• Failing to reconcile the SCC package with the DPA, leaving duplication, inconsistency, or silent conflict.
• Ignoring transfer-risk findings and therefore omitting supplementary contractual commitments where needed.
• Writing the cover memo as a narrative summary only, without explaining the drafting choices, alternatives considered, and remaining open items.

3. Legal frameworks / domain conventions that apply

• Use the applicable SCC structure for cross-border personal data transfers under the EU transfer framework, with the module determined by the exporter/importer relationship.
• If the data transfer assessment indicates non-adequate destination law or access-risk concerns, incorporate supplementary contractual and technical commitments consistent with the transfer framework and the assessment findings.
• If UK personal data is in scope, use the applicable UK transfer addendum or equivalent UK transfer mechanism as a separate instrument alongside the SCCs.
• Treat the DPA as the baseline processing agreement; the SCC addendum supplements it and should avoid inconsistency with the DPA’s scope, definitions, and operational terms.
• Populate Annex I with the parties, roles, transfer description, categories of data, data subjects, purposes, frequency, processing period, and supervisory authority information drawn from the engagement documents.
• Populate Annex II with concrete technical and organizational measures, stated as obligations rather than generic security aspirations.
• Populate Annex III with the authorized subprocessors, their locations, the work they perform, and any associated safeguards or transfer mechanism.
• Use the governing transfer text and the DPA together as the legal frame; where the addendum addresses the same topic more specifically, ensure the documents are coordinated rather than duplicative.

4. Analytical scaffolds

• Start by mapping the processing chain: exporter, importer, controller/processor roles, transfer direction, and the data sets covered.
• Read the DPA, MSA, SOW, security summary, subprocessor list, and transfer-impact assessment as a single package; do not draft from one document in isolation.
• Confirm whether the SCC package needs one module or more than one transfer instrument based on the documented role structure; if only one relationship applies, say so in the memo and explain why.
• Translate security controls into enforceable drafting: specify access controls, encryption, incident handling, logging, segregation, backup, and onward-transfer constraints as applicable to the record.
• Translate the transfer-impact analysis into drafting choices: if supplementary measures are needed, state them as commitments, restrictions, or operational conditions in the addendum package.
• Populate every annex from the source record; if a requested item is missing, flag it as an open item rather than inventing a placeholder.
• For the cover memo, explain the module selection, the basis for any optional or supplemental clauses, how UK data is handled, how transfer-risk findings are reflected, and what remains to be confirmed.

5. Vertical / structural / temporal relationships

• The SCC addendum supplements the DPA and should be drafted to sit downstream of, and consistent with, the existing processing framework.
• If the SCC addendum and the DPA overlap, the addendum should control only for the transfer-specific terms within its scope; the DPA should continue to govern the broader processing relationship.
• A UK transfer addendum is a separate instrument that cross-references the SCC package; it does not replace the EU/EEA transfer clauses.
• Annex content should track the actual processing lifecycle: what data is transferred, for what purposes, for how long, by whom, and under what safeguards.

6. Output structure conventions

• Prepare two deliverables: an SCC addendum package and a client cover memo.
• Draft the SCC addendum as an operative contract form with the selected transfer clause set, any required supplemental provisions, and fully populated annexes.
• If UK personal data is in scope, include the UK transfer addendum as a distinct document or distinct attachment within the package, clearly tied to the main SCC addendum.
• Write the cover memo as an advisory document that explains: why the clause set was selected, what assumptions were made, what optional provisions were included or omitted, how the transfer-risk analysis was addressed, and which items still need client confirmation.
• Use conventional legal drafting headings and annex structure; do not copy an internal checklist or placeholder-heavy format.
• Deliverable filenames must match the instructions exactly: scc-addendum.docx and client-cover-memo.docx.
• Before finishing, confirm that scc-addendum.docx exists and contains operative contractual text, and that client-cover-memo.docx exists and contains substantive drafting guidance.