Part of the GDPR guide
Standard Contractual Clauses: Which Module Do You Need?
The EU's standard contractual clauses are the most common way to transfer personal data from the EEA to a country without an adequacy decision. The 2021 version is a single document with four modules, several options and three annexes, and picking the wrong combination is a common error. Here is how to get it right.
What the clauses are
Under Article 46(2)(c) GDPR, standard data protection clauses adopted by the Commission provide appropriate safeguards for transfers to third countries. The current set was adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The old 2001 and 2010 clauses were repealed from 27 September 2021, and contracts on the old clauses stopped providing safeguards on 27 December 2022 (Article 4 of the decision). If a contract still refers to the old clauses, it needs replacing.
You only need them where no adequacy decision applies. Transfers to an adequate country, or to a US organisation on the Data Privacy Framework List, need no clauses; see our Data Privacy Framework guide.
The four modules
Choose the module that matches the role of each party in the transfer. The exporter is the party sending the data, the importer the party receiving it outside the EEA.
| Module | Exporter → importer | Typical example |
|---|---|---|
| One | Controller → controller | Sharing customer data with a distributor or partner outside the EEA that uses it for its own purposes |
| Two | Controller → processor | Using a US or Indian SaaS, hosting or support provider that processes data on your behalf |
| Three | Processor → processor | A processor in the EEA engaging a sub-processor outside the EEA |
| Four | Processor → controller | An EEA processor returning data to its customer, a controller outside the EEA |
One contract can combine modules if the parties play different roles for different transfers, and you can have several modules between the same parties. What matters is that each transfer, described in Annex I.B, is covered by the module that fits it.
Module Two does double duty: under Article 1(2) of the decision and Clause 2(a), Modules Two and Three also set out the processor terms that Article 28(3) and (4) GDPR require. Many providers still attach a separate data processing agreement; check that it does not contradict the clauses. See our DPA checklist.
What you must fill in
| Item | What to decide or complete |
|---|---|
| Clause 7 (optional) | Docking clause: lets new parties accede later by completing the Appendix and signing Annex I.A. Useful for groups of companies |
| Clause 9 (Modules Two and Three) | Sub-processors: Option 1, specific prior authorisation, or Option 2, general written authorisation from an agreed list, with a notice period you fill in |
| Clause 11 (optional) | Whether data subjects may also lodge complaints with an independent dispute resolution body at no cost |
| Clause 13 and Annex I.C | The competent supervisory authority, which depends on where the exporter is established or, for exporters outside the EU, where its representative is |
| Clause 17 | Governing law: for Modules One to Three, the law of an EU Member State that allows third-party beneficiary rights; for Module Four, the law of a country that does |
| Clause 18 | Courts: an EU Member State for Modules One to Three, with data subjects also able to sue where they live; for Module Four, the courts of the country you choose |
| Annex I | A. the parties; B. description of the transfer: categories of data subjects and data, sensitive data, frequency, purpose, retention; C. the supervisory authority |
| Annex II (Modules One to Three) | Technical and organisational measures, which the explanatory note says must be described in specific, not generic, terms |
| Annex III (Modules Two and Three) | List of sub-processors, required where you chose specific authorisation under Clause 9, Option 1 |
You cannot edit the clauses
Clause 2(a) says the clauses provide appropriate safeguards only if they are not modified, except to select modules and options and to fill in the Appendix. You may put them in a wider contract and add clauses or safeguards, as long as these do not contradict the clauses, directly or indirectly, or prejudice data subjects' rights. A liability cap or a governing law clause in the main contract that overrides the clauses' own terms is the classic conflict; Clause 5 says the clauses prevail.
When the clauses cannot be used
Under Article 1(1) of the decision and recital 7, the clauses cover transfers to an importer whose processing is not subject to the GDPR. If the importer is itself subject to the GDPR under Article 3(2), because it offers goods or services to people in the EU or monitors their behaviour there, these clauses are not designed for that transfer. The Commission says it is developing additional clauses for importers whose processing is directly subject to the GDPR; check its standard contractual clauses page for the current status before relying on a workaround.
Exporters outside the EU that are themselves subject to the GDPR under Article 3(2) can use the clauses as exporters; Clause 13 sets out which authority supervises them.
Signing is not the end
- Transfer impact assessment. Under Clause 14 both parties warrant that the destination country's laws and practices do not prevent the importer from complying, and must document the assessment. Our TIA guide covers the method. For Module Four, Clause 14 applies only where the EU processor combines the data received with personal data it collected in the EU.
- Government access requests. Clause 15 requires the importer to notify the exporter of legally binding requests, where it is allowed to, and to challenge unlawful ones.
- Onward transfers. The importer may pass data on to a third party outside the EU, even in its own country, only under the conditions in Clause 8, for example if the recipient is or agrees to be bound by the clauses, or the onward transfer goes to an adequate country.
- Transparency. Data subjects can ask for a copy of the clauses, and your privacy notice should name the safeguard and how to obtain it.
- Suspension. Under Clause 16, if the importer cannot comply, the exporter must suspend the transfer, and may terminate the contract if compliance is not restored, as a rule within one month.
Common mistakes
- Choosing Module One for a SaaS provider that only acts on your instructions: that is a processor, so Module Two.
- Leaving Annex I.B or Annex II generic, such as "industry-standard security".
- Forgetting remote access: the EDPB treats access from outside the EEA to data stored in the EEA, such as a support engineer viewing production data, as a transfer too.
- Overriding the clauses with the main contract's liability, law or forum terms.
- Signing without a transfer impact assessment, or never reviewing it.
Document the assessment. The Privacy Impact Assessment Bundle includes a transfer impact assessment template, a DPIA template, a DPIA screening checklist and register, a data protection by design checklist and a DPO consultation record.
Sources
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries, Articles 1 and 4, recital 7, Clauses 2, 5, 7, 8, 9, 11, 13 to 18 and Annexes I to III, EUR-Lex
- European Commission, Standard contractual clauses (SCC), including the Questions and Answers of 25 May 2022
- Regulation (EU) 2016/679 (GDPR), Articles 3(2), 28 and 44 to 46, EUR-Lex
- EDPB Recommendations 01/2020 on measures that supplement transfer tools, version 2.0 (18 June 2021)
- Court of Justice, Schrems II, C-311/18, 16 July 2020, EUR-Lex
Related tools
Further reading: Transfer Impact Assessment (TIA) · Data Processing Agreement Checklist
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.