Scc Implementation

Implementing Standard Contractual Clauses

Overview

Commission Implementing Decision (EU) 2021/914 of 4 June 2021 introduced modernised Standard Contractual Clauses (SCCs) for the transfer of personal data to third countries under Regulation (EU) 2016/679. These SCCs replaced the prior sets adopted under Directive 95/46/EC and became the mandatory instrument from 27 December 2022. The modular architecture allows parties to select the appropriate clause set based on their roles in the transfer relationship.

Module Selection Decision Framework

Module 1: Controller to Controller (C2C)

When to use: The data exporter is a controller and the data importer independently determines the purposes and means of processing the imported data as a separate controller.

Typical scenarios at Athena Global Logistics:

• Sharing shipment tracking data with overseas partner logistics firms that independently process that data for their own route optimisation
• Providing employee data to a foreign group entity that acts as an independent controller for local employment law compliance
• Transferring customer data to an overseas insurance partner that underwrites cargo policies under its own controllership

Key Module 1 clauses:

• Clause 8.1 — Data protection safeguards: The data importer must process data only for the specific purposes described in Annex I, with an independent legal basis under the importer's applicable law
• Clause 8.2 — Purpose limitation: The importer shall not process data for purposes incompatible with those for which the data was transferred
• Clause 8.3 — Transparency: The importer must provide data subjects with a copy of the clauses and Annex I information upon request
• Clause 8.4 — Accuracy: Both parties must take reasonable steps to ensure data is accurate and up to date
• Clause 8.5 — Duration and erasure: Data processed only for the duration specified in Annex II; erasure or return upon termination

Module 2: Controller to Processor (C2P)

When to use: The data exporter is a controller and the data importer processes data on behalf of the exporter as a processor.

Typical scenarios at Athena Global Logistics:

• Engaging a cloud infrastructure provider headquartered in a third country to host the transport management system
• Using an overseas payroll processing bureau to calculate salaries for locally-hired staff
• Contracting a third-country call centre to handle customer service inquiries on behalf of the company

Key Module 2 clauses:

• Clause 8.1 — Instructions: The processor shall process data only on documented instructions from the controller as specified in Annex II
• Clause 8.2 — Purpose limitation: Processing solely for the specific purposes set out in Annex I
• Clause 8.3 — Transparency: Controller must inform data subjects of the transfer and identity of the importer
• Clause 8.5 — Sub-processing: Sub-processors only with prior specific or general written authorisation; same data protection obligations imposed by contract
• Clause 8.6 — International onward transfers: Sub-processor transfers require the same level of protection
• Clause 8.8 — Security: Technical and organisational measures as described in Annex II
• Clause 8.9 — Documentation and compliance: Processor must maintain records and allow audits

Module 3: Processor to Processor (P2P)

When to use: The data exporter is a processor (acting on behalf of an EU controller) and the data importer is a sub-processor.

Typical scenarios at Athena Global Logistics:

• The company acts as a data processor for a European shipping consortium and sub-contracts warehousing data management to a third-country sub-processor
• A managed IT services provider contracted by the company further sub-processes personal data with an offshore development centre

Key Module 3 clauses:

• Clause 8.1 — Instructions: Sub-processor processes only under the chain of instructions ultimately originating from the controller
• Clause 8.5 — Onward sub-processing: Further sub-processing only with prior specific or general written authorisation from the controller (obtained through the initial processor)
• Clause 8.8 — Security measures: Annex II security measures apply equivalently
• Clause 8.9 — Documentation and compliance: Full audit chain maintained back to the controller

Module 4: Processor to Controller (P2C)

When to use: The data exporter is a processor and the data importer is the controller whose data is being returned or transferred.

Typical scenarios at Athena Global Logistics:

• Returning processed analytics results to a non-EU client controller who originally provided the raw shipment data
• A European cloud processor returning personal data to its non-EU controller client upon contract termination

Key Module 4 clauses:

• Clause 8.1 — The importer shall process data in compliance with its obligations under the GDPR (where applicable) or equivalent standards
• Clause 8.2 — Purpose limitation and transparency obligations on the importer as controller

Module Selection Decision Tree

START: Identify the role of the data EXPORTER (EU-based party)
  |
  ├── Exporter is a CONTROLLER
  |     |
  |     ├── Importer determines its OWN purposes → MODULE 1 (C2C)
  |     |
  |     └── Importer processes ON BEHALF of exporter → MODULE 2 (C2P)
  |
  └── Exporter is a PROCESSOR
        |
        ├── Importer is a SUB-PROCESSOR → MODULE 3 (P2P)
        |
        └── Importer is the CONTROLLER (data return) → MODULE 4 (P2C)

Annex I: List of Parties and Transfer Details

Section A — List of Parties

Section B — Description of Transfer

Section C — Competent Supervisory Authority

The competent supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), identified in accordance with Clause 13 as the supervisory authority of the Member State in which the data exporter is established.

Annex II: Technical and Organisational Measures

Annex III: List of Sub-Processors

Clause-by-Clause Implementation Checklist

Section I — General Clauses (All Modules)

Section II — Obligations of the Parties

Section III — Local Laws and Government Access

Section IV — Final Provisions

SCC Execution and Record-Keeping

1. Version control: Maintain a register of all executed SCCs with version numbers, execution dates, parties, and selected modules.
2. Periodic review: Review all executed SCCs at least annually or upon any material change in processing, importer jurisdiction law, or sub-processor arrangements.
3. Regulatory updates: Monitor EDPB guidance and European Commission updates for any revision to the SCC instrument or supplementary guidance.
4. Integration with TIA: Each SCC must reference the corresponding Transfer Impact Assessment documenting the assessment of the importer's jurisdiction under Clause 14.
5. Supervisory authority cooperation: Maintain readiness to provide all SCC documentation to the competent supervisory authority upon request under Art. 46(2)(c) and Art. 58(1).